Short-lived QR image URL

Fetch a QR image using the short-lived signature from MCP create_qr. The signature binds the code, format, pixel size, expiry, and owner. It is not an API key, OAuth token, or session. Cookies and Authorization are ignored. A missing, tampered, or non-owner signature is 404. An expired signature is 410. Fetching this URL does not record a visit. Cache-Control is private, no-store. When signing is not configured, every request is 404. Returns the stored link's QR as PNG, or SVG when requested, with a short-lived image URL where available. The QR encodes qr_tracking_url. Where an image is not displayed, image_url (when present) or the short link reaches the same code.