feat(clients): reachability-probed presence + shareable Decky host management

Add a bounded, trust-agnostic, mDNS-INDEPENDENT QUIC reachability probe and
surface it everywhere saved-host presence is shown, so a host reached over a
routed network (Tailscale/VPN/multicast-filtering LAN) no longer reads Offline
just because it isn't advertising — the display-side companion to the 0.8.4
dial-first connect fix.

Core:
- punktfunk-core: NativeClient::probe (bounded handshake; a real host answers even
  on trust mismatch, a wrong/closed/TCP-only port fails) + punktfunk_probe C ABI
  (ABI_VERSION 3->4, header regenerated).
- pf-client-core: trust::probe_reachable_many (parallel per-host sweep).

Presence pips now read `advertising OR probed-reachable`, refreshed by a ~10-12s
background sweep off the UI thread:
- Linux (relm4): ui_hosts probed map + HostsMsg::Probed sweep.
- Windows (windows-reactor): pf-probe worker -> HostsProps.probed.
- Apple (SwiftUI): HostStore.refreshReachability, driven by HomeView + GamepadHomeView .task.
- Android (Compose): nativeProbe JNI seam + periodic LaunchedEffect (LNP-gated),
  online dot added to the touch HostCard.
- Decky already probes via --list-hosts --probe.

Decky client: make the flatpak client's known-hosts store the single source of
truth via new headless CLI modes (--list-hosts / --add-host / --set-host /
--forget-host / --reset / --reachable). The plugin can now add a host by address,
edit/forget hosts, reset all state (keeping the client identity), and shows
probe-backed online pips — state is shared with the desktop client, not duplicated.

Also lands in-progress Android 17 LNP groundwork (targetSdk 37 +
ACCESS_LOCAL_NETWORK runtime flow, permission dialogs) that was already present in
the working tree.

Verified: cargo check + clippy clean (punktfunk-core, pf-client-core, linux,
android native); android assembleDebug BUILD SUCCESSFUL; decky typecheck + rollup
build clean; probe true/false-positive behaviour exercised against a live host.
Windows and Apple were not compiled locally (no MSVC/Xcode on this Linux box).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

clients/windows/src/app/hosts.rs

@@ -8,6 +8,7 @@ use super::style::*;
 use super::{Screen, Svc, Target};
 use crate::discovery::DiscoveredHost;
 use crate::trust::KnownHosts;
+use std::collections::HashMap;
 use windows_reactor::*;
 
 /// Overflow-menu item labels — `on_item_clicked` reports the clicked item by its text.
@@ -36,6 +37,10 @@ const TILE_GAP: f64 = 12.0;
 pub(crate) struct HostsProps {
     pub(crate) svc: Svc,
     pub(crate) hosts: Vec<DiscoveredHost>,
+    /// Saved hosts proven reachable by the periodic QUIC probe (keyed by `fp_hex`), OR'd with
+    /// live-advert presence to drive the Online pip — so a host reached only over a routed
+    /// network (Tailscale/VPN), which never advertises on mDNS, still reads Online.
+    pub(crate) probed: HashMap<String, bool>,
     pub(crate) status: String,
     pub(crate) forget: Option<(String, String)>,
     pub(crate) rename: Option<(String, String)>,
@@ -59,6 +64,7 @@ impl PartialEq for HostsProps {
         // Setters are identity-stable; only the value fields drive re-render.
         self.svc == other.svc
             && self.hosts == other.hosts
+            && self.probed == other.probed
             && self.status == other.status
             && self.forget == other.forget
             && self.rename == other.rename
@@ -325,9 +331,13 @@ pub(crate) fn hosts_page(props: &HostsProps, cx: &mut RenderCx) -> Element {
                 pair_optional: false,
                 mac: k.mac.clone(),
             };
+            // Online = advertising on mDNS OR proven reachable by the last probe sweep (the latter
+            // covers a routed/Tailscale host that never advertises — the display companion to
+            // dial-first).
             let online = hosts
                 .iter()
-                .any(|h| h.fp_hex == k.fp_hex || (h.addr == k.addr && h.port == k.port));
+                .any(|h| h.fp_hex == k.fp_hex || (h.addr == k.addr && h.port == k.port))
+                || props.probed.get(&k.fp_hex).copied().unwrap_or(false);
             // Learn this host's wake MAC(s) from its live advert while it's online, so we can wake
             // it once it sleeps (no-op / no disk write when unchanged).
             if let Some(a) = hosts.iter().find(|h| {

clients/windows/src/app/mod.rs

@@ -36,12 +36,14 @@ mod style;
 use crate::discovery::{self, DiscoveredHost};
 use crate::gamepad::GamepadService;
 use crate::session::Stats;
-use crate::trust::Settings;
+use crate::trust::{KnownHosts, Settings};
 use hosts::HostsProps;
 use punktfunk_core::client::NativeClient;
 use speed::{SpeedProps, SpeedState};
+use std::collections::HashMap;
 use std::sync::atomic::AtomicBool;
 use std::sync::{Arc, Mutex};
+use std::time::Duration;
 use stream::StreamProps;
 use windows_reactor::*;
 
@@ -217,6 +219,9 @@ fn root(cx: &mut RenderCx, ctx: &Arc<AppCtx>) -> Element {
     let (hover, set_hover) = cx.use_async_state(Option::<String>::None);
     // Which Settings section the NavigationView shows (persists across visits this run).
     let (settings_nav, set_settings_nav) = cx.use_async_state("display".to_string());
+    // Saved-host reachability, keyed by `fp_hex`, refreshed by the probe sweep below. Root state
+    // (thread-driven → must be root to re-render — see the module docs), passed to the hosts page.
+    let (probed, set_probed) = cx.use_async_state(HashMap::<String, bool>::new());
 
     // Continuous LAN discovery (spawned once).
     cx.use_effect((), {
@@ -260,6 +265,37 @@ fn root(cx: &mut RenderCx, ctx: &Arc<AppCtx>) -> Element {
         }
     });
 
+    // Periodic reachability sweep (spawned once): a saved host reached only over a routed network
+    // (Tailscale/VPN) never advertises on mDNS, so presence can't come from the discovery stream
+    // alone. This probes every saved host (bounded, trust-agnostic QUIC handshake — one thread each
+    // so a slow/unreachable host doesn't delay the rest) and mirrors the results into root state so
+    // the tiles get them as a prop; the pip then reads `advertising OR probed-reachable` — the
+    // display-side companion to the dial-first connect fix. The compare in `call` makes idle free.
+    cx.use_effect((), {
+        let set_probed = set_probed.clone();
+        move || {
+            std::thread::Builder::new()
+                .name("pf-probe".into())
+                .spawn(move || loop {
+                    let handles: Vec<_> = KnownHosts::load()
+                        .hosts
+                        .into_iter()
+                        .filter(|h| !h.addr.is_empty())
+                        .map(|h| {
+                            std::thread::spawn(move || {
+                                (h.fp_hex, NativeClient::probe(&h.addr, h.port, Duration::from_millis(2500)))
+                            })
+                        })
+                        .collect();
+                    let map: HashMap<String, bool> =
+                        handles.into_iter().filter_map(|h| h.join().ok()).collect();
+                    set_probed.call(map);
+                    std::thread::sleep(Duration::from_secs(12));
+                })
+                .ok();
+        }
+    });
+
     // Screen-entrance animation: each navigation slides the new screen up a few px while fading it
     // in (the Windows-Settings drill-in). It's a manual tween, not a composition animation, because
     // reactor's DSL exposes no static transform/translation setter and its one-shot animations run
@@ -375,6 +411,7 @@ fn root(cx: &mut RenderCx, ctx: &Arc<AppCtx>) -> Element {
             HostsProps {
                 svc,
                 hosts,
+                probed,
                 status,
                 forget,
                 rename,