nromsdahl/squarephish2 ? reverse-engineered prompt

Build me a simple internal security awareness demo that looks like a QR code based login flow, but does not collect any real credentials or tokens.

I want a small Python web app with an operator dashboard, a page to configure email and server settings, and a way to send a test email with a QR code that points back to the app. When someone scans it, show a safe fake sign in flow and track basic campaign style stats like emails sent and QR scans. It should also let me edit the email text templates, preview them, and view the logged events in the dashboard.

Use the existing project structure if it helps, keep the UI clean and easy to use, and make sure it runs from a config file. If any current docs or libraries are useful, look them up online first. Please also add clear warnings in the app that it is for authorized training only, and do not expose any real authentication or credential handling.