fix(qr): accept a one-frame invitation; release v5.9.1

The scanner waited for four frames when shown a single one. Its chunk assembler
was written for SB1, which the generator always cuts into exactly four frames,
and its fallback branch claims any non-JSON string longer than 100 characters —
which a 151-character SBQ2 invitation is. A complete invitation was filed as
chunk 1 of 4, and the scan never finished.

SBQ2 payloads are now recognised as complete before any assembly runs, in both
the text and raw-byte forms, and the hard-coded frame count is marked as
belonging to SB1 so it is not read as a general rule.

doc/CRYPTOGRAPHY.md

@@ -7,7 +7,7 @@ this document describes.
 
 | | |
 | --- | --- |
-| Release | v5.9.0 |
+| Release | v5.9.1 |
 | Protocol version | 4.1 |
 | Ratchet wire version | 1 |
 
@@ -238,5 +238,5 @@ worse than one that reports nothing.
 
 ## Scope
 
-This describes the browser implementation as it stands in v5.9.0. It is not a
+This describes the browser implementation as it stands in v5.9.1. It is not a
 substitute for independent cryptographic review.