feat(host,web): multi-GPU selection — GPU inventory + preference API, web-console GPU card

- new crate::gpu (compiled on all platforms so the OpenAPI doc stays
  platform-independent): DXGI / sysfs GPU inventory with reboot-stable ids
  (PCI vendor:device + occurrence — LUIDs are per-boot), persisted auto/manual
  preference (<config>/gpu-settings.json, atomic temp+rename with in-memory
  rollback), one selection with precedence console preference >
  PUNKTFUNK_RENDER_ADAPTER > max VRAM and graceful fallback when the preferred
  GPU is absent, plus a live "in use" record (RAII session guard wrapped around
  every encoder open_video returns)
- fix: windows_gpu_vendor derived the encoder backend from DXGI adapter 0
  instead of the selected render adapter — on a hybrid box (e.g. Intel iGPU at
  index 0 + NVIDIA dGPU) the backend could disagree with the GPU the capture
  ring / IddCx render pin sit on. The NVENC 4:4:4 probe now also runs on the
  selected adapter (was: OS default), the codec/4:4:4 probe caches are keyed
  per selected GPU (were process-lifetime OnceLocks), and an explicit
  PUNKTFUNK_ENCODER conflicting with the selected GPU's vendor warns up front
- mgmt API: GET /api/v1/gpus (inventory + mode + preferred + next-session
  selection with reason + in-use GPU/backend/session-count) and
  PUT /api/v1/gpus/preference (validates mode/gpu_id before writing);
  openapi.json regenerated; the vdisplay render pin now also engages for a
  console preference (not just the env pin)
- web console: GPU card on the Host page — list with vendor + VRAM,
  Automatic / Prefer controls, Preferred / Next session / "In use · backend"
  badges, missing-preferred-GPU warning and env-pin note; en + de messages
- Linux: a matched manual preference picks the VAAPI render node and the
  NVENC-vs-VAAPI auto choice; auto mode is exactly the previous behavior

Validated live on the hybrid laptop (RTX 3500 Ada + Intel Arc Pro, which
enumerates twice — the occurrence ids disambiguate): enumerate, prefer,
bad-id 400, restart persistence, auto-restore keeping the stored pick.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/punktfunk-host/src/encode/linux/vaapi.rs

@@ -50,10 +50,13 @@ const fn fourcc(a: u8, b: u8, c: u8, d: u8) -> u32 {
     (a as u32) | ((b as u32) << 8) | ((c as u32) << 16) | ((d as u32) << 24)
 }
 
-/// The render node a VAAPI/DRM device should open. `PUNKTFUNK_RENDER_NODE` pins it on a multi-GPU
-/// box; the default is correct on a single-GPU host.
+/// The render node a VAAPI/DRM device should open, from [`crate::gpu::linux_render_node`]: a
+/// matched web-console GPU preference pins it, else `PUNKTFUNK_RENDER_NODE`, else the single-GPU
+/// default.
 fn render_node() -> CString {
-    let p = std::env::var("PUNKTFUNK_RENDER_NODE").unwrap_or_else(|_| "/dev/dri/renderD128".into());
+    let p = crate::gpu::linux_render_node()
+        .to_string_lossy()
+        .into_owned();
     CString::new(p).unwrap_or_else(|_| CString::new("/dev/dri/renderD128").unwrap())
 }
 

crates/punktfunk-host/src/encode/windows/ffmpeg_win.rs

@@ -254,6 +254,11 @@ pub fn probe_can_encode_444(_vendor: WinVendor, _codec: Codec) -> bool {
 }
 
 pub fn probe_can_encode(vendor: WinVendor, codec: Codec) -> bool {
+    // Deliberately NOT pinned to the selected render adapter (unlike `nvenc::probe_can_encode_444`):
+    // the system-input probe passes no hwdevice, and the AMF/QSV runtimes only ever bind their own
+    // vendor's silicon — on a mixed-vendor box the probe lands on the right GPU by construction.
+    // Only a two-same-vendor-GPU box could probe the wrong card (accepted; results are cached per
+    // selected GPU in `windows_codec_support`, so a fix here slots in without churn).
     if ffmpeg::init().is_err() {
         return false;
     }

crates/punktfunk-host/src/encode/windows/nvenc.rs

@@ -958,34 +958,59 @@ impl Drop for NvencD3d11Encoder {
 /// so the host advertises the chroma it can really encode (honest downgrade to 4:2:0 on a card without it).
 pub fn probe_can_encode_444(codec: Codec) -> bool {
     use windows::Win32::Foundation::HMODULE;
-    use windows::Win32::Graphics::Direct3D::{D3D_DRIVER_TYPE_HARDWARE, D3D_FEATURE_LEVEL_11_0};
+    use windows::Win32::Graphics::Direct3D::{
+        D3D_DRIVER_TYPE_HARDWARE, D3D_DRIVER_TYPE_UNKNOWN, D3D_FEATURE_LEVEL_11_0,
+    };
     use windows::Win32::Graphics::Direct3D11::{
         D3D11CreateDevice, D3D11_CREATE_DEVICE_BGRA_SUPPORT, D3D11_SDK_VERSION,
     };
+    use windows::Win32::Graphics::Dxgi::{CreateDXGIFactory1, IDXGIAdapter1, IDXGIFactory4};
     if codec != Codec::H265 {
         return false;
     }
-    // SAFETY: a self-contained probe owning every handle it creates. `D3D11CreateDevice` (HARDWARE
-    // driver, NULL adapter) fills `device` or returns Err (→ false). `open_encode_session_ex` opens an
-    // NVENC session against that device's raw pointer (valid while `device` is held) or errors (→ false,
-    // tearing nothing down). `get_encode_caps` reads one scalar cap into `val` via the loaded API table.
-    // `destroy_encoder` frees the session exactly once; `device`/its context drop with the COM wrappers.
-    // No handle escapes this call and nothing runs concurrently.
+    // SAFETY: a self-contained probe owning every handle it creates. `CreateDXGIFactory1`/
+    // `EnumAdapterByLuid` return owned COM objects or err (→ default-adapter fallback).
+    // `D3D11CreateDevice` (explicit adapter + UNKNOWN driver type, or NULL adapter + HARDWARE)
+    // fills `device` or returns Err (→ false). `open_encode_session_ex` opens an NVENC session
+    // against that device's raw pointer (valid while `device` is held) or errors (→ false, tearing
+    // nothing down). `get_encode_caps` reads one scalar cap into `val` via the loaded API table.
+    // `destroy_encoder` frees the session exactly once; `device`/its context drop with the COM
+    // wrappers. No handle escapes this call and nothing runs concurrently.
     unsafe {
+        // Probe on the SELECTED render adapter — the GPU the session will actually encode on
+        // (web-console preference / PUNKTFUNK_RENDER_ADAPTER / max VRAM). The OS default adapter
+        // (NULL) can be the *other* GPU on a hybrid box, answering for hardware we won't use.
+        let adapter: Option<IDXGIAdapter1> = crate::win_adapter::resolve_render_adapter_luid()
+            .and_then(|luid| {
+                let factory: IDXGIFactory4 = CreateDXGIFactory1().ok()?;
+                factory.EnumAdapterByLuid(luid).ok()
+            });
         let mut device: Option<ID3D11Device> = None;
-        if D3D11CreateDevice(
-            None,
-            D3D_DRIVER_TYPE_HARDWARE,
-            HMODULE::default(),
-            D3D11_CREATE_DEVICE_BGRA_SUPPORT,
-            Some(&[D3D_FEATURE_LEVEL_11_0]),
-            D3D11_SDK_VERSION,
-            Some(&mut device),
-            None,
-            None,
-        )
-        .is_err()
-        {
+        let created = match &adapter {
+            Some(a) => D3D11CreateDevice(
+                a,
+                D3D_DRIVER_TYPE_UNKNOWN,
+                HMODULE::default(),
+                D3D11_CREATE_DEVICE_BGRA_SUPPORT,
+                Some(&[D3D_FEATURE_LEVEL_11_0]),
+                D3D11_SDK_VERSION,
+                Some(&mut device),
+                None,
+                None,
+            ),
+            None => D3D11CreateDevice(
+                None,
+                D3D_DRIVER_TYPE_HARDWARE,
+                HMODULE::default(),
+                D3D11_CREATE_DEVICE_BGRA_SUPPORT,
+                Some(&[D3D_FEATURE_LEVEL_11_0]),
+                D3D11_SDK_VERSION,
+                Some(&mut device),
+                None,
+                None,
+            ),
+        };
+        if created.is_err() {
             return false;
         }
         let Some(device) = device else { return false };