接入移动端原生扫码能力

新增 scanner.scanQrCode HostBridge 契约与二维码结果归一。

接入 Expo Camera 扫码 overlay 并保留 H5 浏览器扫码回退。

让 Tauri 白名单识别扫码 method 但不声明桌面扫码能力。

同步原生壳门禁、Expo 权限检查、方案文档和共享决策记录。

apps/desktop-shell/scripts/check-config.mjs

@@ -1080,7 +1080,11 @@ const desktopCapabilities = extractDesktopCapabilities(
 const desktopHandledMethods = extractDesktopHandledMethods(
   desktopHostBridgeDispatchSource,
 );
-const sdkBackedCapabilities = ['auth.requestLogin', 'payment.request'];
+const hostBridgeAcceptedUnsupportedMethods = [
+  'auth.requestLogin',
+  'payment.request',
+  'scanner.scanQrCode',
+];
 if (desktopHostBridgeProtocol !== sharedHostBridgeProtocol) {
   throw new Error(
     `desktop shell HostBridge protocol drifted: expected ${sharedHostBridgeProtocol} but got ${desktopHostBridgeProtocol}`,
@@ -1200,7 +1204,7 @@ assertSameList(
   'desktop shell HostBridge capability profile',
 );
 
-for (const capability of sdkBackedCapabilities) {
+for (const capability of ['auth.requestLogin', 'payment.request']) {
   if (desktopCapabilities.includes(capability)) {
     throw new Error(
       `desktop shell must not declare ${capability} until a real SDK/channel flow is implemented`,
@@ -1221,7 +1225,8 @@ if (missingDesktopMethodHandlers.length > 0) {
 
 const undeclaredDesktopMethodHandlers = desktopHandledMethods.filter(
   (method) =>
-    !desktopCapabilities.includes(method) && !sdkBackedCapabilities.includes(method),
+    !desktopCapabilities.includes(method) &&
+    !hostBridgeAcceptedUnsupportedMethods.includes(method),
 );
 if (undeclaredDesktopMethodHandlers.length > 0) {
   throw new Error(