fix(mobile): harden QR auth, token handling, and OTA reliability

[snehasishcodes]

Implements critical fixes from mobile deep audit.

Security:

• Strict QR validation in @crosscode/shared (8KB cap, base64 regex, token/email/URL checks, block metadata IP, https enforcement)
• Login QR no longer trusted directly; verified via device-link claim + server account fetch with zod-style shape checks
• Tunnel token moved out of router query params into in-memory pending-connection store
• secureFetch helper enforces https + 15s timeout for claim/account/health
• Link modal allowlisted to https/mailto with canOpenURL
• btoa replaced with UTF-8-safe base64, auth cache capped at 10 and cleared on logout/remove
• SecureStore made fail-safe with AsyncStorage fallback instead of silent data loss
• Connections use randomUUID and dedupe by URL
• .gitignore now ignores all .env files

Reliability:

• OTA switched to ON_ERROR_RECOVERY + 30s cache fallback, safe reload with catch, no mid-stream kill
• Widget refresh throttled 800ms to 5s
• Widget data reads SecureStore fallback and fixes sessions/stats shape bugs (was always empty/offline)

Follow-ups (not in scope): server-side POST body for claim token, HMAC-signed QR, biometric/screenshot guards, FlashList virtualization for viewer.