feat(webapp): live in-app QR scanner with photo-upload fallback

[cgoulart35]

What

Replaces the single-photo file-upload Scan flow with a live in-browser camera scanner that decodes continuously and fires the fight the instant a QR is in frame. Keeps photo-upload as a fallback.

Three tiers, best-effort down:

1. Native BarcodeDetector — Chrome / Android (fast, on-device)
2. Vendored jsQR — iOS Safari and anything else without BarcodeDetector
3. Existing photo upload → /scan/ (cv2) — no camera / permission denied / desktop

Why

One-shot photos were unreliable (blur, framing, round-trip). The new scanner is an in-page <video> overlay, so:

• More contained — the happy path never leaves the app (no OS camera sheet, no file picker); the post-scan location = is a same-origin /fight/ nav, so it stays inside the installed PWA window.
• Less Pi load — decoding runs on the phone; the server does no QR image processing unless the photo fallback is used.

Notes

• resolveFightUrl() is a shared guard that only follows a decoded value resolving to a same-origin /fight/ URL — hardens both the live and photo paths over the old unguarded location = text.
• jsQR is vendored as a static asset (no runtime CDN dependency; the official npm dist is unminified, ~257 KB raw / ~60 KB gzipped). A small tests/test_static_assets.py guards its presence/sanity.
• getUserMedia needs a secure context, which prod (HTTPS behind the Cloudflare tunnel) already serves. No API/route/requirements changes.

Verification

• /test — full suite green (69 passed), incl. the new asset guard; test_qr_decode.py still covers the cv2 fallback.
• Cross-phone QA on the real domain (qa sandbox): Android Chrome (BarcodeDetector), macOS Safari + iPhone Safari (jsQR, rear camera + inline playback), plus deny-permission → photo fallback and the "Use photo instead" button.

🤖 Generated with Claude Code

[claude]

🔴 One must-fix: decodeWithJsQR in index.js is missing the jsQR(...) call — code is never declared, so every scan tick throws a ReferenceError and the rAF loop dies silently. This completely breaks the jsQR fallback path (iOS Safari, any browser without BarcodeDetector). Fix: add var code = jsQR(imageData.data, width, height); before the return. See inline comment.