Exposes /api/v1/qr-codes with analytics, team account header support, and qr:read/qr:write token abilities. Co-authored-by: Cursor <cursoragent@cursor.com>