fix: add Cache-Control to /qr, re-fetch QR on each popover open

Cache-Control: no-store prevents stale QR after LAN IP change.
Remove qrLoaded flag so the QR always reflects the current IP.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

site/dashboard.html

@@ -797,13 +797,12 @@ function formatTime(epoch) {
   return d.toLocaleTimeString([], { hour12: false });
 }
 
-let qrLoaded = false;
 let mobilePort = 8765;
 function togglePhoneSetup() {
   const pop = document.getElementById('phoneSetupPopover');
   const isOpen = pop.style.display !== 'none';
   pop.style.display = isOpen ? 'none' : 'block';
-  if (!isOpen && !qrLoaded) {
+  if (!isOpen) {
     if (window.innerWidth <= 700) {
       document.getElementById('qrContainer').style.display = 'none';
       const linkEl = document.getElementById('phoneSetupLink');
@@ -813,7 +812,6 @@ function togglePhoneSetup() {
     } else {
       fetch(API + '/qr').then(r => r.text()).then(svg => {
         document.getElementById('qrContainer').innerHTML = svg;
-        qrLoaded = true;
       }).catch(() => {
         document.getElementById('qrContainer').innerHTML = '<div class="empty-state">Could not load QR</div>';
       });

src/api.rs

@@ -956,7 +956,10 @@ async fn serve_qr(State(ctx): State<Arc<ServerCtx>>) -> Result<impl IntoResponse
         .dark_color(qrcode::render::svg::Color("#2c2418"))
         .light_color(qrcode::render::svg::Color("#faf7f2"))
         .build();
-    Ok(([(header::CONTENT_TYPE, "image/svg+xml")], svg))
+    Ok(([
+        (header::CONTENT_TYPE, "image/svg+xml"),
+        (header::CACHE_CONTROL, "no-store"),
+    ], svg))
 }
 
 async fn serve_fonts_css() -> impl IntoResponse {