fix: replace require('qrcode') with await import() for ESM compatibility

require() is not defined in ESM modules. The production build (tsc)
outputs ESM, causing 'require is not defined' → 500 → 'QR unavailable'.
Vitest/tsx shimmed require() so tests passed but production was broken.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/tunnel-manager.ts

@@ -362,8 +362,7 @@ export class TunnelManager extends EventEmitter {
     if (!code) throw new Error('No QR token available');
     if (this.cachedQrSvg?.shortCode === code) return this.cachedQrSvg.svg;
 
-    // eslint-disable-next-line @typescript-eslint/no-require-imports -- dynamic optional dependency
-    const QRCode = require('qrcode');
+    const QRCode = await import('qrcode');
     const svg: string = await QRCode.toString(`${tunnelUrl}/q/${code}`, {
       type: 'svg',
       margin: 2,

src/web/routes/system-routes.ts

@@ -112,8 +112,7 @@ export function registerSystemRoutes(
         return { svg, authEnabled: true };
       }
       // No auth — just encode the raw tunnel URL
-      // eslint-disable-next-line @typescript-eslint/no-require-imports -- dynamic optional dependency
-      const QRCode = require('qrcode');
+      const QRCode = await import('qrcode');
       const svg: string = await QRCode.toString(url, { type: 'svg', margin: 2, width: 256 });
       return { svg, authEnabled: false };
     } catch (err) {