fix: replace require('qrcode') with await import() for ESM compatibility

require() is not defined in ESM modules. The production build (tsc)
outputs ESM, causing 'require is not defined' → 500 → 'QR unavailable'.
Vitest/tsx shimmed require() so tests passed but production was broken.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/web/routes/system-routes.ts

@@ -112,8 +112,7 @@ export function registerSystemRoutes(
         return { svg, authEnabled: true };
       }
       // No auth — just encode the raw tunnel URL
-      // eslint-disable-next-line @typescript-eslint/no-require-imports -- dynamic optional dependency
-      const QRCode = require('qrcode');
+      const QRCode = await import('qrcode');
       const svg: string = await QRCode.toString(url, { type: 'svg', margin: 2, width: 256 });
       return { svg, authEnabled: false };
     } catch (err) {