fix(backend): make tunnel relay reachable before baking it into QR

Two changes so off-network wallet scanning actually works:

- Force the cloudflared edge connection over http2 (TCP/443) instead of
  QUIC (UDP/7844) in both the Docker tunnel and the dev-tunnel script.
  QUIC is blocked on many networks/Docker setups, which left the tunnel
  stuck "Failed to dial a quic connection" and the QR pointing at a dead
  URL — the root cause of "must be on the same network" failures.
- Gate the discovered quick-tunnel URL on real end-to-end reachability:
  poll the tunnel's own /health until it answers (Cloudflare 1033 clears
  in ~30s) before publishing it, and have /pair await that discovery so
  the QR never carries a not-yet-live URL.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/scripts/dev-tunnel.mjs

@@ -35,7 +35,9 @@ console.log(`\n⛅ Starting Cloudflare tunnel to http://localhost:${PORT} …\n`
 
 const tunnel = spawn(
   "cloudflared",
-  ["tunnel", "--url", `http://localhost:${PORT}`],
+  // --protocol http2 keeps the edge connection on TCP/443 (QUIC/UDP is blocked
+  // on many networks and would leave the tunnel unable to connect).
+  ["tunnel", "--no-autoupdate", "--protocol", "http2", "--url", `http://localhost:${PORT}`],
   { stdio: ["ignore", "pipe", "pipe"] },
 );