fix: generate the TOTP QR internally

[YasharF]

Checklist

• I acknowledge that submissions that include copy-paste of AI-generated content taken at face value (PR text, code, commit message, documentation, etc.) most likely have errors and hence will be rejected entirely and marked as spam or invalid
• I manually tested the change with a running instance, DB, and valid API keys where applicable
• Added/updated tests if the existing tests do not cover this change
• README or other relevant docs are updated
• --no-verify was not used for the commit(s)
• npm run lint passed locally without any errors
• npm test passed locally without any errors
• npm run test:e2e:replay passed locally without any errors
• npm run test:e2e:custom -- --project=chromium-nokey-live passed locally without any errors
• PR diff does not include unrelated changes
• PR title follows Conventional Commits — https://www.conventionalcommits.org/en

Description

Screenshots of UI changes (browser) and logs/test results (console, terminal, shell, cmd)

[Copilot]

Pull request overview

This PR updates the TOTP setup flow to stop relying on a third-party QR code service and instead render the QR code image generated internally by the server.

Changes:

• Generate a TOTP QR code SVG server-side (as a data: URI) and pass it to the view.
• Update the TOTP setup Pug template to use the internally generated QR image.
• Add the qr dependency and update dependency metadata/lockfile.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 2 comments.

File	Description
controllers/user.js	Generates an SVG QR code data URI for the TOTP URI and passes it to the renderer.
views/account/totp-setup.pug	Renders the QR image from qrImage instead of a remote QR service URL.
package.json	Adds qr; also changes Mocha specifier to a dist-tag (next).
package-lock.json	Locks qr addition but also includes broader dependency churn.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

overrideReasons is not a standard npm field and (unless there is custom tooling consuming it) it will be ignored by npm. If this metadata is needed, consider moving it to a documented location (e.g., CONTRIBUTING/README) or adding tooling that enforces/uses it; otherwise, please remove it to avoid confusion.

Suggested change

	"overrideReasons": {
	"encoding-sniffer": "cheerio",
	"fetch-blob": "@googleapis/drive",
	"formdata-node": "@langchain/groq, @langchain/community"
	},