feat(protocol,clients): codec preference negotiation + Linux client decodes per Welcome (Phase 2a)

Adds a client-selectable **preferred codec** and wires the core + ABI + probe + Linux client to
negotiate and decode it. (Windows/Apple/Android follow in 2b.)

**Core:**
- `Hello.preferred_codec` (a single CODEC_* bit, 0 = auto) — a soft hint appended after
  `video_codecs`. `resolve_codec(client, host, preferred)` now honors the preference when the host
  can also emit it, else falls back to precedence (HEVC > AV1 > H.264). Roundtrip + preference tests.
- `NativeClient::connect` takes `video_codecs` + `preferred_codec`; `NativeClient.codec` exposes the
  resolved `Welcome.codec`.
- ABI: `punktfunk_connect_ex7` (adds the two codec params; `ex6` delegates to it advertising
  HEVC-only) + `punktfunk_connection_codec` getter + `PUNKTFUNK_CODEC_{H264,HEVC,AV1}` constants
  (drift-guarded against the wire values). Header regenerated.

**Host:** passes `hello.preferred_codec` into `resolve_codec`.

**probe:** `--codec h264|hevc|av1|auto` sets the preference (still advertises it can decode all
three); the dump extension already follows the resolved codec.

**Linux client:** advertises the codecs FFmpeg can actually decode (`decodable_codecs()`), threads
the user's `codec` setting as the preference, and builds the decoder — both the software and VAAPI
paths, plus the mid-session VAAPI→software demotion — from the negotiated `Welcome.codec` instead of
hardcoding HEVC. New "Video codec" dropdown in Preferences (Automatic/HEVC/H.264/AV1).

Live-validated on the dev box: probe `--codec hevc` against a software (H.264-only) host resolves to
H.264 (graceful soft-preference fallback), no failure. clippy + core (57) + host (133) tests green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packaging/windows/punktfunk-host.iss

@@ -285,8 +285,9 @@ end;
 
 function WebSetupParams(Param: String): String;
 begin
-  { Pass the password to web-setup.ps1 via a temp file, not the cmdline (which lands in the install
-    log). Only on a fresh install - on upgrade web-setup keeps the existing file. }
+  { Pass the password to `punktfunk-host.exe web setup` via a temp file, not the cmdline (which
+    lands in the install log). Only on a fresh install - on upgrade web setup keeps the existing
+    file. }
   Result := '--app-dir "' + ExpandConstant('{app}') + '"';
   if FreshWebInstall then
     Result := Result + ' --password-file "' + ExpandConstant('{tmp}\webpw.txt') + '"';
@@ -312,7 +313,7 @@ end;
 #ifdef WithWeb
 { Stop a running web console + free :3000 BEFORE the file copy, so the old server doesn't lock
   .output / web-run.cmd / bun.exe and the new task can bind. Killing the :3000 listener owner is
-  runtime-agnostic (an early install may have run node, the current one runs bun). web-setup.ps1
+  runtime-agnostic (an early install may have run node, the current one runs bun). `web setup`
   repeats this idempotently after the copy. Best-effort; a fresh install is a no-op. }
 procedure StopWebConsole;
 var
@@ -334,7 +335,7 @@ begin
     StopHostServiceAndWait;
 #ifdef WithWeb
     StopWebConsole;   { upgrade-safe: free :3000 + unlock the web files before the copy }
-    { Stash the chosen password for web-setup.ps1 (fresh install only); the temp copy is auto-cleaned. }
+    { Stash the chosen password for `web setup` (fresh install only); the temp copy is auto-cleaned. }
     if FreshWebInstall then
       SaveStringToFile(ExpandConstant('{tmp}\webpw.txt'), Trim(WebPwPage.Values[0]), False);
 #endif