Add one-time setup links as an alternative to the QR code

A config can now be handed over as a one-time link, valid for 1 h, 24 h or
7 days and protected by a PIN by default. Keys are made only when the link
is opened; the link works once and is revoked after 5 wrong PINs. Issuing a
new config offers the same choice, and the current config keeps working
until the link is used.

Remove the option to paste a client's public key, in the web UI, the API
and the iOS app.

kernel_other.go

@@ -30,7 +30,7 @@ func (k *simKernel) Apply(c *Config) error {
 	defer k.mu.Unlock()
 	keep := map[string]bool{}
 	for i, p := range c.Peers {
-		if !p.Enabled {
+		if !p.Enabled || !p.hasKey() {
 			continue
 		}
 		keep[p.PublicKey] = true