feat(api,frontend): add qr code login

backend/src/api/routers/accounts.py

@@ -37,7 +37,8 @@ class PasswordRequest(BaseModel):
 
 class LoginState(BaseModel):
     login_id: str
-    stage: Literal["code", "password", "done"]
+    stage: Literal["code", "qr", "password", "done"]
+    qr_url: str | None = None
     account: AccountView | None = None
 
 
@@ -79,6 +80,24 @@ async def start_login(body: PhoneRequest) -> LoginState:
     return LoginState(login_id=login_id, stage="code")
 
 
+@router.post("/accounts/login/qr")
+async def start_qr_login() -> LoginState:
+    login_id, url = await _guard(login_manager.start_qr())
+    return LoginState(login_id=login_id, stage="qr", qr_url=url)
+
+
+@router.get("/accounts/login/{login_id}/qr")
+async def poll_qr_login(login_id: str, pool: FromDishka[asyncpg.Pool]) -> LoginState:
+    state = await _guard(login_manager.wait_qr(login_id))
+    if state.user is not None:
+        return await _complete(pool, login_id, state.user)
+    if state.password_needed:
+        return LoginState(login_id=login_id, stage="password")
+    if state.error is not None:
+        raise HTTPException(status.HTTP_400_BAD_REQUEST, state.error)
+    return LoginState(login_id=login_id, stage="qr", qr_url=state.url)
+
+
 @router.post("/accounts/login/{login_id}/code")
 async def submit_code(
     login_id: str, body: CodeRequest, pool: FromDishka[asyncpg.Pool]