Tickets: payment → QR ticket → check-in with scanner, no repeat entry

Tickets: payment → QR → check-in with scanner, no repeat entry Main (40 seconds, one click): visitor clicks 'Get a demo ticket' → test card payment one-click → ticket with QR on screen and second QR 'open scanner on phone' next to it → points phone at screen → '✓ ENTRY ALLOWED, seat B12', and same second ticket page (SSE) changes to 'checked in 0.4 s ago · Gate A'. Scans second time — '✗ ALREADY USED, 0:07 ago at Gate A'. Two devices, live link, no apps. Second layer — 'break it and watch it hold' (Attack lab panel): 1. Fake ticket: edit ID inside token → '✗ INVALID SIGNATURE'. 2. Screenshot to friend: event with code rotation (30 s) — old screenshot at entry gives '✗ EXPIRED CODE', live…