QR device-handoff login ("scan to sign in") for PhoenixKit.

This is the PhoenixKit-side integration of the keyfob library. Keyfob owns the rendezvous — request lifecycle, expiry, single-use enforcement, the secret split, PubSub signaling. This module wires it into PhoenixKit: the internal PubSub, the qr_login_enabled setting, device-metadata extraction for the confirm screen, and activity logging on approval.

The flow

1. A signed-out browser opens /users/qr-login (PhoenixKitWeb.Users.QrLogin) and a QR encoding the phone-confirm URL is shown. The LiveView waits.
2. The user's already-signed-in phone scans it, opens the confirm URL (PhoenixKitWeb.Users.QrLoginConfirm), reviews the requesting device, and taps Approve — which calls approve/2 with the phone user's uuid.
3. Approval mints a one-time login token delivered over PubSub only to the waiting browser, which navigates to the completion controller (PhoenixKitWeb.Users.QrLoginComplete).
4. The controller calls consume/1 ({:ok, user_uuid}, exactly once) and logs that user in with PhoenixKit's own session machinery.

Approval always happens on the trusted (phone) device; the browser gets nothing until the phone approves. See keyfob's docs for the threat model (QR-jacking, the secret split).

All keyfob calls are routed through PhoenixKit's internal PubSub (:phoenix_kit_internal_pubsub) so the desktop LiveView and the phone confirm LiveView rendezvous on the same bus. The default Keyfob.Store.ETS (started in PhoenixKit.Supervisor) holds requests.