On 3 I could see the api just redirecting back to the app. And 4 is retained for future backup?
Just to share how this is made smoother somewhere else in the world: App displays QR code on screen either on webpage or in-store POS, user scans QR code, payment is made and funds transfered instantly.
I was thinking either pinging or some sort of a "check" button that the user would click/tap (e.g. Cloudflare's button to check the status of NS transfers). Not the smoothest part of the idea. This decision would ultimately be left to the consumer of the API. Also, in thinking this through a little more I think it is also applicable to applications that do have their own backend, in which case they could provide a callback.
I like your idea on 3/4. That could maybe be a configurable option