malware-check: update text w/ more explanation

src/malware-check/InitMalwareCheck.tsx

@@ -139,12 +139,35 @@ export const MalwareCheck = ({
             <MalwareCheckQRCode url={qrUrl} />
 
             <div className="max-w-sm">
-              <p className="mb-2">
+              <p className="mb-3">
                 <span className="block text-[10px] uppercase tracking-wide text-black/40 mb-1">beta feature</span>
                 As an additional layer of security, you can use multiple&nbsp;devices to verify your vote was submitted
                 as intended.
               </p>
-              <p className="mb-2 text-xs text-black/50">⚠️ This QR contains your private vote selections.</p>
+
+              <div className="text-[11px] text-black/60 space-y-1.5 mb-3">
+                <p>
+                  <span className="font-medium text-black/70">How:</span> Before each check, refresh the page to
+                  generate a new QR code.
+                </p>
+                <p>
+                  <span className="font-medium text-black/70">What happens:</span> Scanning or copy/pasting the link
+                  rebuilds your encrypted vote on a different device and asks the server if it matches the original
+                  submission.
+                </p>
+              </div>
+
+              <p className="mb-2 text-[11px] text-black/50">
+                ⚠️ This QR contains your private vote selections.{' '}
+                <a
+                  className="underline hover:text-black/70"
+                  href="https://docs.siv.org/verifiability/detecting-malware"
+                  rel="noopener noreferrer"
+                  target="_blank"
+                >
+                  Learn more →
+                </a>
+              </p>
               {checkStatus && checkStatus.verified_count > 0 && (
                 <p className="mt-2 text-sm text-green-600">
                   Verified with {checkStatus.verified_count} separate device{checkStatus.verified_count > 1 ? 's' : ''}