feat(clients): reachability-probed presence + shareable Decky host management

Add a bounded, trust-agnostic, mDNS-INDEPENDENT QUIC reachability probe and
surface it everywhere saved-host presence is shown, so a host reached over a
routed network (Tailscale/VPN/multicast-filtering LAN) no longer reads Offline
just because it isn't advertising — the display-side companion to the 0.8.4
dial-first connect fix.

Core:
- punktfunk-core: NativeClient::probe (bounded handshake; a real host answers even
  on trust mismatch, a wrong/closed/TCP-only port fails) + punktfunk_probe C ABI
  (ABI_VERSION 3->4, header regenerated).
- pf-client-core: trust::probe_reachable_many (parallel per-host sweep).

Presence pips now read `advertising OR probed-reachable`, refreshed by a ~10-12s
background sweep off the UI thread:
- Linux (relm4): ui_hosts probed map + HostsMsg::Probed sweep.
- Windows (windows-reactor): pf-probe worker -> HostsProps.probed.
- Apple (SwiftUI): HostStore.refreshReachability, driven by HomeView + GamepadHomeView .task.
- Android (Compose): nativeProbe JNI seam + periodic LaunchedEffect (LNP-gated),
  online dot added to the touch HostCard.
- Decky already probes via --list-hosts --probe.

Decky client: make the flatpak client's known-hosts store the single source of
truth via new headless CLI modes (--list-hosts / --add-host / --set-host /
--forget-host / --reset / --reachable). The plugin can now add a host by address,
edit/forget hosts, reset all state (keeping the client identity), and shows
probe-backed online pips — state is shared with the desktop client, not duplicated.

Also lands in-progress Android 17 LNP groundwork (targetSdk 37 +
ACCESS_LOCAL_NETWORK runtime flow, permission dialogs) that was already present in
the working tree.

Verified: cargo check + clippy clean (punktfunk-core, pf-client-core, linux,
android native); android assembleDebug BUILD SUCCESSFUL; decky typecheck + rollup
build clean; probe true/false-positive behaviour exercised against a live host.
Windows and Apple were not compiled locally (no MSVC/Xcode on this Linux box).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/punktfunk-core/src/client.rs

@@ -708,6 +708,56 @@ impl NativeClient {
         })
     }
 
+    /// A lightweight, trust-agnostic reachability check: attempt the QUIC/TLS handshake to
+    /// `host:port` and report whether the host answered — WITHOUT relying on mDNS presence.
+    ///
+    /// The saved-hosts "online" pip historically read a host as offline whenever it wasn't
+    /// currently advertising on mDNS, so a host reached over a routed network (Tailscale / VPN /
+    /// another subnet) — which is mDNS-blind forever — always looked offline even though it was
+    /// perfectly reachable (the same failure the dial-first reconnect fix addressed for the
+    /// connect action). This probe answers the real question ("does the box respond on the
+    /// stream port?") by completing just the handshake and tearing it straight down.
+    ///
+    /// No pin and no identity are presented: hosts accept the transport-level connection
+    /// regardless of pairing (client-cert auth is not mandatory at the QUIC layer —
+    /// authorization is enforced per-feature), so a completed handshake means "reachable". A
+    /// wrong address, closed port, or unroutable host fails the connect/`timeout` and yields
+    /// `false`. Blocks up to `timeout`.
+    pub fn probe(host: &str, port: u16, timeout: Duration) -> bool {
+        let Ok(rt) = tokio::runtime::Builder::new_current_thread()
+            .enable_all()
+            .build()
+        else {
+            return false;
+        };
+        let host = host.to_string();
+        rt.block_on(async move {
+            // The stored address may be a hostname (Tailscale MagicDNS, an mDNS `.local` name),
+            // not a bare IP literal, so resolve it rather than `SocketAddr::parse`.
+            let Ok(mut addrs) = tokio::net::lookup_host((host.as_str(), port)).await else {
+                return false;
+            };
+            let Some(remote) = addrs.next() else {
+                return false;
+            };
+            // TOFU verifier (pin = None) accepts any cert, so a real host always completes the
+            // handshake; the only failures are DNS / no route / connect timeout.
+            let (ep, _observed) = endpoint::client_pinned_with_identity(None, None);
+            let Ok(ep) = ep else {
+                return false;
+            };
+            let reachable = match ep.connect(remote, "punktfunk") {
+                Ok(connecting) => {
+                    matches!(tokio::time::timeout(timeout, connecting).await, Ok(Ok(_)))
+                }
+                Err(_) => false,
+            };
+            ep.close(0u32.into(), b"probe");
+            let _ = tokio::time::timeout(Duration::from_millis(200), ep.wait_idle()).await;
+            reachable
+        })
+    }
+
     /// The currently active session mode — the Welcome's, until an accepted
     /// [`NativeClient::request_mode`] switches it.
     pub fn mode(&self) -> Mode {