fix(auth): complete and verify QR login

[dapi]

Summary

• Keep MTProto updates enabled during QR login so the scan confirmation reaches mtcute, then reopen the saved session before reporting success.
• Explain when Telegram requires a 2FA password after a QR scan and avoid submitting an empty password repeatedly.
• Close an active login prompt on timeout so the process can exit and release the store lock.

Verification

• npm test: 315 tests passed across 21 files on the current main.
• npm start with an isolated empty store: reached the expected missing-configuration startup path.
• Manual check with an authorized profile running 2.8.7: tgcli auth status returned authenticated; tgcli doctor reported lockHeld: false.

Console output

Waiting for Telegram to confirm the QR login...
Telegram requires your 2FA password to finish QR login:
QR login verified from saved session.

Telegram may still require the account's 2FA password after QR confirmation. This change reports that requirement clearly; it does not bypass it.