Validate QR campaign payloads for destination fit, UTM hygiene, privacy, scan context, and fallback safety