refactor(host/windows): clean up DDA path + add a proper Windows service

Final cleanup after the DDA-parity work, plus an end-user service to replace the
PsExec/VBS/scheduled-task launch chain.

Cleanup (behavior-preserving):
- sudovda.rs: drop the dead legacy GDI isolate_displays/restore_displays (CCD is
  the sole isolation path), the always-empty Monitor.isolated field, and the
  vestigial reassert_isolation + PUNKTFUNK_ISOLATE_DISPLAYS knob; fix stale comments.
- dxgi.rs: downgrade leftover debug warns/infos (DuplicateOutput1 retry, FALLBACKS,
  hook-hits, AcquireNextFrame idle timeout) to debug!; remove the PUNKTFUNK_NO_CURSOR
  per-frame test knob.

Windows service (src/service.rs, `punktfunk-host service`):
- SCM supervisor (windows-service crate) that duplicates its LocalSystem token,
  retargets it to the active console session, and CreateProcessAsUserW's the host
  there (Sunshine/Apollo model) — relaunching on exit and console session switch,
  inside a kill-on-close job object so a service crash never orphans the host.
- install/uninstall/start/stop/status subcommands: one elevated `service install`
  registers an auto-start LocalSystem service + firewall rules + a default host.env.
- Config moves to %ProgramData%\punktfunk\host.env; config_dir() now resolves to
  %ProgramData%\punktfunk on Windows (replacing the APPDATA=C:\Users\Public hack),
  with a PUNKTFUNK_CONFIG_DIR override. Logs land in %ProgramData%\punktfunk\logs\.
- merged_env_block (shared with the WGC helper) now also carries RUST_LOG.
- docs/windows-service.md + scripts/windows/host.env.example; windows-host.md updated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/windows-host.md

@@ -74,14 +74,26 @@ Driven by live testing with the native macOS client at the display's native **51
   detaches other monitors so Winlogon renders to the virtual output) covers the case where a physical
   monitor is also attached.
 
-### Running as SYSTEM, windowless (deployment)
+### Running as SYSTEM (deployment) — the `PunktfunkHost` service
 
 To capture the secure desktop the host must run as **SYSTEM in the interactive Session 1** (a Session
-0 service can't duplicate Session 1). Launch chain: a scheduled task (Interactive, Highest) →
-`PsExec64 -s -i 1 -d wscript.exe launch.vbs` → `launch.vbs` runs `host-run.cmd` with a **hidden
-window** (`WScript.Shell.Run …, 0`). This keeps the host off the captured desktop — no `cmd` windows
-the user can see or accidentally close (which would kill the stream). `host-run.cmd` sets
-`APPDATA=C:\Users\Public` (shared identity/pairing) + `PUNKTFUNK_ENCODER=nvenc` and runs `m3-host`.
+0 service can't duplicate Session 1). The end-user deployment is the built-in Windows **service**
+(`src/service.rs`) — see [`windows-service.md`](windows-service.md). One elevated command:
+
+```powershell
+punktfunk-host service install   # auto-start LocalSystem service + firewall rules + default host.env
+punktfunk-host service start
+```
+
+The service runs in Session 0 but never captures: it duplicates its own LocalSystem token, retargets
+it to the active console session, and `CreateProcessAsUserW`s the host there — supervising it across
+exits and console-session switches (the Sunshine/Apollo model). Config lives in
+`%ProgramData%\punktfunk\host.env`; logs in `%ProgramData%\punktfunk\logs\`.
+
+> **Old bring-up chain (debug only, superseded by the service):** a scheduled task (Interactive,
+> Highest) → `PsExec64 -s -i 1 -d wscript.exe launch.vbs` → `host-run.cmd` (hidden window), with
+> `APPDATA=C:\Users\Public` as the shared-identity hack. The service replaces all of this; the host
+> now resolves its config dir to `%ProgramData%\punktfunk` directly (`PUNKTFUNK_CONFIG_DIR` overrides).
 
 ### Real-GPU test box (RTX 4090, `ssh "Enrico Bühler"@192.168.1.174`)