kgretzky/evilqr ? reverse-engineered prompt

Build me a simple security awareness demo that shows how QR code login pages can be fooled, but keep it completely harmless and local.

I want a small browser extension and a tiny server that work together to swap in a fake QR code on a demo page, using placeholder data only. It should help me show people why QR based sign in can be risky, without connecting to real services or collecting any real credentials. Please make it easy to run on my machine, with clear setup steps and a local page I can open in Chrome to see the demo working.

If you need current docs or examples for the browser extension or server setup, look them up online. Also, keep the code easy to customize so I can change the demo text, colors, and local address before I run it.