Smartphone remote

Bash
npx recit dev slides.md --remote

The terminal prints a QR code: scan it with a phone on the same network to go forward, back, and read your notes. Press R in the deck to show the QR code again. The server listens on the local network only with --remote (or --host).

Two separate tokens protect it, and they are needed for every route, not only the remote one: from the machine itself nothing is asked, but a browser on the network gets nothing — not the deck, not its media, not the live-reload stream — without a token. The terminal prints the link that carries the screen's token; the QR code carries the phone's. A phone that is passed around can drive the deck, never take the screen's place. The token travels once in the URL, then in a HttpOnly cookie.