Add QR pairing (terminal QR, in-app scanner, iris://pair deep link)

docs/17-future-control-surface.md

@@ -153,7 +153,7 @@ Config + setup per provider — `web_server.py` `/api/memory/providers/*`.
    `app/shared/.../protocol/Protocol.kt` → `docs/protocol/frames.schema.json`).
 2. **Security is the real gate.** The single-user model in
    `09-pairing-security.md` still holds, but control frames widen the blast
-   radius of a leaked `ANDROID_TOKEN`. Sensitive operations (env/secrets,
+   radius of a leaked `IRIS_TOKEN`. Sensitive operations (env/secrets,
    config writes, gateway restart, profile deletion) should get either an
    in-app confirmation step or a capability flag negotiated at pairing.
 3. **Read-heavy first.** Most of the value is in list/view frames (cheap,