Completion endpoint for QR device-handoff login.

The desktop LiveView navigates here once its request is approved on the phone, carrying the one-time login token. This controller exchanges that token for the approved user's uuid (exactly once, via PhoenixKit.Users.QrLogin.consume/1) and establishes the session with PhoenixKit's own login machinery.

Keyfob's login token is single-use and short-lived, so a replayed or stale URL lands on the login page rather than signing anyone in.