Your /qrcode requests sends everything to backend

        GET
 https://auth.web.id/qrcode?chl=otpauth://totp/Example%20Inc.sdf:johsn%40example.com?issuer=Example%20Inc.sdf&secret=SA&algorithm=SHA1&digits=6&period=30

> all computations are performed client-side with no data storage

so this isn't true.

I am sure you can generate the qr code on the client as well