fix: use phone-reachable relay URL in wallet-import QR

The "Import from a patient app → QR" code baked the web app's own
API_BASE_URL (typically http://localhost:4000) into the pairing URI, so a
real phone could never reach the relay and "Scan to connect" silently
stalled. Use the backend's server-resolved, device-reachable relay URL
instead (PUBLIC_RELAY_URL, else the request host), surface it on the
WalletPairing type, and document PUBLIC_RELAY_URL in .env.example.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/.env.example

@@ -30,6 +30,15 @@ NODE_ENV=development
 # already in use on your machine (the app still talks to Postgres internally).
 POSTGRES_PORT=5432
 
+# --- Patient wallet relay -------------------------------------------------
+# The URL baked into the QR a patient scans to import their record. Their phone
+# must be able to reach it — so localhost will NOT work from a real device. If
+# unset, the backend derives it from the request host (fine when you open the
+# web app over your LAN IP, e.g. http://192.168.1.20:3000). Otherwise set it
+# explicitly to a phone-reachable address: your machine's LAN IP or a public
+# tunnel URL.
+# PUBLIC_RELAY_URL=http://192.168.1.20:4000
+
 # --- Email (optional) -----------------------------------------------------
 # If SMTP_HOST is unset, emails (verify/reset/invite) are printed to the
 # server console instead of being sent — zero setup for local development.