Add QR pairing (terminal QR, in-app scanner, iris://pair deep link)

docs/setup.md

@@ -9,7 +9,7 @@ just the steps.
 ## Prerequisites
 
 | Where | You need |
-|---|---|
+| --- | --- |
 | Gateway host | hermes installed with its venv (`cd hermes-agent && uv sync`, see [`12-toolchain.md` §12.4](12-toolchain.md)) |
 | Android build machine | JDK 17, Android SDK with `ANDROID_HOME` set (or `app/local.properties`), ADB with a connected device |
 | Desktop build machine | JDK 17 only |
@@ -24,8 +24,8 @@ root):
 
 ```bash
 mkdir -p ~/.hermes/plugins
-ln -s "$PWD/gateway-plugin" ~/.hermes/plugins/android
-hermes gateway status        # should list "android"
+ln -s "$PWD/gateway-plugin" ~/.hermes/plugins/iris
+hermes gateway status        # should list "iris"
 ```
 
 Run the interactive setup:
@@ -36,12 +36,13 @@ hermes gateway setup
 
 What it does:
 
-- Generates `ANDROID_TOKEN` (64 hex chars) if none exists and stores it in
+- Generates `IRIS_TOKEN` (64 hex chars) if none exists and stores it in
   `~/.hermes/.env` (it prints the token once, at generation).
 - Prompts for the WS bind host (default `127.0.0.1`), port (default `8790`),
   and push backend (`fcm` or `ntfy`, default `fcm`).
 - Prints the pairing payload (a QR-encodable `iris://pair?host=…&port=…&token=…`
-  string) and the server URL (`ws://<host>:8790/ws`).
+  string), a scannable QR of that payload, and the server URL
+  (`ws://<host>:8790/ws`).
 
 Then start the gateway:
 
@@ -52,7 +53,7 @@ hermes gateway               # or: hermes gateway restart after config changes
 > **Note:** the default bind host `127.0.0.1` only accepts connections from the
 > gateway host itself (e.g. a desktop app on the same machine). For a phone on
 > the LAN, re-run `hermes gateway setup` (or edit `~/.hermes/.env`) and set
-> `ANDROID_WS_HOST` to the host's LAN IP (e.g. `192.168.1.10`).
+> `IRIS_WS_HOST` to the host's LAN IP (e.g. `192.168.1.10`).
 
 ## 2. Android app
 
@@ -68,12 +69,14 @@ First run opens the **Connect** screen:
 1. **Server URL** — `ws://<gateway-ip>:8790/ws` (the URL printed by
    `hermes gateway setup`; use the LAN IP, not `127.0.0.1`, from a phone).
 2. **Pairing token** — from the `hermes gateway setup` output, or
-   `grep ANDROID_TOKEN ~/.hermes/.env` on the gateway host.
+   `grep IRIS_TOKEN ~/.hermes/.env` on the gateway host.
 3. **Test & Connect** — performs a real `hello` (the auth leg), then saves the
    pairing and connects.
 
-> **Honest limitation:** QR scanning is **not** supported in the app yet. The
-> server prints a QR payload, but pairing is manual URL + token entry only.
+> **Scan QR (Android):** the Connect screen has a **Scan QR** button (CameraX +
+> ML Kit) that reads the QR printed by `hermes gateway setup` and pre-fills the
+> URL + token. Desktop has no camera, so it uses manual entry. An `iris://pair`
+> deep link (from any scanner) pre-fills the same way.
 
 ## 3. Desktop app
 
@@ -104,8 +107,8 @@ high-priority events (approvals, clarifies, cron) even when a device is live.
    `app/androidApp/`.
 2. Create a service account (Project settings → Service accounts → Generate new
    private key) and store the JSON path in `~/.hermes/.env`:
-   `ANDROID_FCM_SERVICE_ACCOUNT=/path/to/service-account.json`.
-3. Keep `ANDROID_PUSH_BACKEND=fcm` (the default).
+   `IRIS_FCM_SERVICE_ACCOUNT=/path/to/service-account.json`.
+3. Keep `IRIS_PUSH_BACKEND=fcm` (the default).
 
 Without a Firebase project the FCM path is **inert** (the app's FCM service
 does nothing) — use ntfy below, or add Firebase later.
@@ -116,7 +119,7 @@ backgrounded; tapping one deep-links to the chat.
 ### ntfy (zero-config fallback)
 
 ```
-ANDROID_PUSH_BACKEND=ntfy
+IRIS_PUSH_BACKEND=ntfy
 ```
 
 - The device **generates its own topic** automatically (no `NTFY_TOPIC` needed);
@@ -135,7 +138,7 @@ the app is off; incoming pushes trigger a silent sync.
   the app connects to `ws://<tailnet-ip>:8790/ws`. No public exposure.
 - **Reverse proxy / tunnel** (Caddy, Cloudflare Tunnel, ngrok): terminate TLS at
   the edge, forward the WebSocket to `127.0.0.1:8790`.
-- **WSS:** set `ANDROID_WS_CERT` / `ANDROID_WS_KEY` (paths, in
+- **WSS:** set `IRIS_WS_CERT` / `IRIS_WS_KEY` (paths, in
   `~/.hermes/.env`) and the server serves `wss://` instead of `ws://`.
 
 > **Honest limitation:** the app has **no certificate pinning** yet, so
@@ -145,8 +148,8 @@ the app is off; incoming pushes trigger a silent sync.
 ## 6. Troubleshooting
 
 | Symptom | Likely cause / fix |
-|---|---|
-| `auth failed` / `error {code:"auth"}` on connect | Wrong token. Check `ANDROID_TOKEN` in `~/.hermes/.env` on the gateway host (setup prints it only when it generates it). |
+| --- | --- |
+| `auth failed` / `error {code:"auth"}` on connect | Wrong token. Check `IRIS_TOKEN` in `~/.hermes/.env` on the gateway host (setup prints it only when it generates it). |
 | Connection refused | Gateway not running (`hermes gateway status`); wrong URL (port `8790`, path `/ws`, LAN IP instead of `127.0.0.1` from a phone); firewall blocking the port. |
 | Push not arriving | Backend not configured (gateway log: `push backend … not configured`); app backgrounded with no working backend; ntfy.sh SSE flakiness — use a self-hosted ntfy. |
 | Desktop jpackage launcher warning | Non-fatal (JDK-8348560 on Linux JDK 17); the app runs and connects regardless. |
@@ -159,7 +162,7 @@ import asyncio, json, websockets
 async def main():
     async with websockets.connect("ws://127.0.0.1:8790/ws") as ws:
         await ws.send(json.dumps({"v":1,"type":"hello","payload":{
-            "token":"<ANDROID_TOKEN>","device_id":"test","device_name":"probe",
+            "token":"<IRIS_TOKEN>","device_id":"test","device_name":"probe",
             "caps":{"min_protocol":1}}}))
         print("recv:", await ws.recv())
 asyncio.run(main())
@@ -167,4 +170,4 @@ PY
 ```
 
 Expect a `hello.ack`. If you get `error {code:"auth"}`, the token/host/port is
-wrong.
+wrong.