feat: Stage 2E physics p95, runtime videos, domain audit, device-test QR

Measure Rapier world.step p95 (~0.2 ms) on GTX 1080, record real route WebMs,
expand runtime/headless hash parity, and document permanent-domain/phone blockers.

Co-authored-by: Cursor <cursoragent@cursor.com>

package.json

@@ -34,6 +34,7 @@
     "@react-three/rapier": "^2.2.0",
     "@vitejs/plugin-react": "latest",
     "postprocessing": "^6.39.4",
+    "qrcode": "^1.5.4",
     "react": "latest",
     "react-dom": "latest",
     "react-router-dom": "^7.18.1",
@@ -47,6 +48,7 @@
     "@gltf-transform/functions": "^4.4.2",
     "@playwright/test": "^1.61.1",
     "@types/node": "^26.1.0",
+    "@types/qrcode": "^1.5.6",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
     "@types/three": "^0.185.0",