Ship uds-auth offline tgz without npm qrcode fetch (0.2.20).

Bundle qrcode SVG into lib/qrcode-bundled.cjs and drop the runtime dependency so Desktop field installs work without registry.npmjs.org.

Co-authored-by: Cursor <cursoragent@cursor.com>

uds-auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "uds-auth",
-  "version": "0.2.19",
+  "version": "0.2.20",
   "description": "UDS authentication plugin for DeepSeek Harness with multi-tenant session isolation",
   "type": "module",
   "main": "lib/index.js",
@@ -17,6 +17,8 @@
     "./package.json": "./package.json"
   },
   "scripts": {
+    "bundle:qrcode": "bun run scripts/bundle-qrcode.mjs",
+    "prepack": "bun run scripts/bundle-qrcode.mjs",
     "test": "node --test test/**/*.test.js"
   },
   "keywords": [
@@ -45,7 +47,8 @@
   "engines": {
     "node": ">=18.0.0"
   },
-  "dependencies": {
+  "dependencies": {},
+  "devDependencies": {
     "qrcode": "1.5.4"
   },
   "peerDependencies": {