Is it safe to send IV in plain text for every request?
Is it safe to send the IV in plain text in every QR code request?
  


IV is not secret and never meant to be, it can be sent as it is. See the CBC mode from the Wikipedia.


  
  When using the same nonce, decryption will still work, what is the purpose or misuse of the nonce here?
  


Nonce (in Cryptography) means number used once. The IV in the CBC mode cannot be nonce. The aim of IV is randomizing the encryptions. Using the same IV again turns the CBC mode into the ECB mode. This has catastrophic results, see the penguin from Wikipedia in or look at frequency attack. 

For the difference of IV and Nonce please see Difference between a nonce and IV


  
  Should I use chacha20 at all? Or is there a much more better encryption/decryption method to use here?
  


You need authenticated encryption which simultaneously give authenticity and integrity. You may choose ChaCha20Poly1305 or AES-GCM.


  
  I need to keep my server's public key secret and only in the firmware of the IoT device, to prevent 'fake devices' generating valid but fake QR codes, which sounds bad.
  


Public keys are not created to be kept secret. The more important is the ID of the IoT that should be sent during the data transmission so that the server can accept the result. Therefore the server must store the ID's beforehand. In the current design, the server is going to accept any message.

Note: You will also need to authenticate the mobile device, otherwise any mobile device can be used to attack. 

Note 2: IV should not be predictable.

Note 3: You don't need to generate if from a nonce. A good random source should be enough. See  Best way to generate a IV for AES-CBC when encrypting files?