- add `qr-code[disabled,scanning]` attributes
- fix user reject media access, still starting a scan with errors