fix(backend): make tunnel relay reachable before baking it into QR

Two changes so off-network wallet scanning actually works:

- Force the cloudflared edge connection over http2 (TCP/443) instead of
  QUIC (UDP/7844) in both the Docker tunnel and the dev-tunnel script.
  QUIC is blocked on many networks/Docker setups, which left the tunnel
  stuck "Failed to dial a quic connection" and the QR pointing at a dead
  URL — the root cause of "must be on the same network" failures.
- Gate the discovered quick-tunnel URL on real end-to-end reachability:
  poll the tunnel's own /health until it answers (Cloudflare 1033 clears
  in ~30s) before publishing it, and have /pair await that discovery so
  the QR never carries a not-yet-live URL.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/index.ts

@@ -31,7 +31,7 @@ import { settingsRouter } from "./routes/settings.js";
 import { signingRouter } from "./routes/signing.js";
 import { staffRouter } from "./routes/staff.js";
 import { tasksRouter } from "./routes/tasks.js";
-import { discoverQuickTunnelUrl } from "./services/relay-url.js";
+import { beginQuickTunnelDiscovery } from "./services/relay-url.js";
 import { sweepExpiredShares } from "./services/wallet-share.js";
 
 const app = express();
@@ -141,5 +141,5 @@ server.listen(env.PORT, () => {
 // (from the `tunnel` compose profile) so the wallet-import QR points at it.
 // No-op unless a tunnel sidecar is configured and PUBLIC_RELAY_URL is unset.
 if (env.CLOUDFLARED_METRICS_URL && !env.PUBLIC_RELAY_URL) {
-  void discoverQuickTunnelUrl(env.CLOUDFLARED_METRICS_URL);
+  void beginQuickTunnelDiscovery(env.CLOUDFLARED_METRICS_URL);
 }