1) GET /api/session_token/:sessionId

2) { token, expiresIn }

3) Present QR: QR1:{s,i,t}

4) POST /api/scan_qr {sessionId, token, studentId, scanType, lat, lng}

5) 201 {status, distanceMeters, student, classCode}

Validate & write attendance (DB)