Standalone extraction of the current login popup: same layout, same visual states, same QR flow, but with reusable neutral endpoint names for moving into a separate repo.
POST /userauth/qr/create
Returns a one-time token and Telegram deeplink for the QR image.
GET /userauth/qr/poll?token=...
Returns pending, confirmed, or expired. On confirmed, also returns the user session.
GET /userauth/session
Cookie-based session lookup used for initial auth check and fallback polling.
POST /usersession/{sessionId}
Existing cart payload is preserved. Only the namespace is generalized for reuse.