Update app.js

fix: render QR via qrcode.js canvas instead of broken ASCII art

revert: clean state, no retry spam

fix: auto-retry with 60s backoff on rate-limit, expose /api/shellular/credentials

fix: pin machine-id + seed shellular config from env vars to bypass rate limit

Initial upload: Shellular Web UI + keep-alive service