fix: use div container for QRCode.js, show element before rendering

fix: bundle qrcode.min.js locally, avoid CSP block on CDN

fix: render QR via qrcode.js canvas instead of broken ASCII art

revert: clean state, no retry spam

fix: auto-retry with 60s backoff on rate-limit, expose /api/shellular/credentials

Initial upload: Shellular Web UI + keep-alive service