feat(packaging): signed Inno Setup installer for the Windows host + CI

MSIX (the client's format) can't install the host's LocalSystem secure-desktop
service or the SudoVDA kernel driver, so the host ships as a signed Inno Setup
setup.exe that runs elevated and delegates to the existing idempotent
`punktfunk-host service install`.

- packaging/windows/punktfunk-host.iss: lay exe into Program Files, optional
  SudoVDA driver task, run service install/start; [Code] stops+waits the service
  before file copy on upgrade; uninstall runs service uninstall.
- pack-host-installer.ps1: cert (reuses MSIX_CERT_PFX_B64 / self-signed CN=unom),
  sign inner exe + setup.exe, fetch/stage SudoVDA, run ISCC, export public .cer.
- fetch-sudovda.ps1 / install-sudovda.ps1: pinned SudoVDA + nefcon download, cert
  import, gated device-node create (no phantom dup), pnputil install (warn-not-abort).
- nvenc/: synthesize nvencodeapi.lib via llvm-dlltool from a 2-export .def so
  --features nvenc links with no GPU/SDK at build time.
- .gitea/workflows/windows-host.yml: build (nvenc) -> clippy -> ISCC -> sign ->
  publish setup.exe + .cer to the generic registry pkg punktfunk-host-windows.
  Tag host-win-v* -> X.Y.Z (+ latest/ alias); main push -> rolling 0.2.<run>.
- setup-windows-runner.ps1: provision Inno Setup; docs: installer instructions.

SudoVDA/nefcon release URLs+SHA-256s in fetch-sudovda.ps1 are placeholders
(baseline v0.2.1) — fetch warns + prints the computed hash until pinned.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs-site/content/docs/running-as-a-service.md

@@ -77,6 +77,22 @@ to be up by the time a client connects, so the ordering is soft.)
 On Bazzite, the host launches its own gamescope/Steam session per client, so you don't need a separate
 session unit — see [Bazzite](/docs/bazzite).
 
+## Windows
+
+On Windows the host runs as a `LocalSystem` service that launches into the interactive session, so it
+captures the secure desktop (UAC / lock screen) and survives reboots with nobody logged in — the same
+model Sunshine/Apollo use.
+
+The easy path is the **signed installer**: download `punktfunk-host-setup-<ver>.exe` from the package
+registry ([`punktfunk-host-windows`](https://git.unom.io/unom/-/packages)) and run it. It drops the host
+into `C:\Program Files\punktfunk`, optionally installs the bundled **SudoVDA** virtual-display driver,
+and registers + starts the service for you (`/VERYSILENT` for unattended). Upgrades and uninstall are
+handled through Add/Remove Programs.
+
+Prefer the CLI? Run `punktfunk-host service install` from an elevated prompt — see
+[Windows service](https://git.unom.io/unom/punktfunk/src/branch/main/docs/windows-service.md). Either
+way you need an NVIDIA GPU + driver (the host is NVENC-only on Windows).
+
 ## Verifying
 
 After a reboot, from another machine on the network: