Add a QR code endpoint for PLM addresses

GET /qr/{address} renders the address as a PNG QR code (qrcode[pil]),
gated by a bech32-shaped regex since it's otherwise unauthenticated —
the address itself isn't sensitive, but this keeps it from being used
as an arbitrary text-to-QR service.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app/api/routes/qr.py

@@ -0,0 +1,22 @@
+import io
+import re
+
+import qrcode
+from fastapi import APIRouter, HTTPException, status
+from fastapi.responses import Response
+
+router = APIRouter(tags=["qr"])
+
+# PLM P2WPKH addresses: bech32 HRP "plm" + separator + witness program.
+_ADDRESS_RE = re.compile(r"^plm1[a-z0-9]{10,90}$")
+
+
+@router.get("/qr/{address}")
+async def address_qr(address: str) -> Response:
+    if not _ADDRESS_RE.match(address):
+        raise HTTPException(status.HTTP_400_BAD_REQUEST, "invalid address")
+
+    image = qrcode.make(address)
+    buf = io.BytesIO()
+    image.save(buf, format="PNG")
+    return Response(content=buf.getvalue(), media_type="image/png")