fix(packaging): open mgmt/library port 47990 on the LAN firewall profiles

The mgmt REST API has bound 0.0.0.0:47990 by default since ae51276 so paired
clients can browse the game library over mTLS, but every packaged firewall
opener still excluded 47990 and the docs still claimed it was loopback-only.
On any host with an active firewall (ufw/firewalld) the LAN game-library
feature was silently broken.

Add 47990/tcp to the native firewall profiles (punktfunk.ufw [punktfunk-native]
+ punktfunk-native.xml) and correct the stale "loopback-only by default" text
across the debian/arch/bazzite READMEs and the docs site (incl. the factually
wrong --mgmt-bind default in host-cli.md, 127.0.0.1 -> 0.0.0.0). Opening the
port adds no admin exposure: off-loopback mgmt::require_auth serves only the
read-only status/library allowlist to a paired client cert; the bearer-token
admin surface stays loopback-only regardless of the bind.

Windows was already sound (shared parse_serve binds 0.0.0.0; service.rs already
firewall-opens 47990) — add a clarifying comment so the rule isn't mistaken for
accidental over-exposure.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs-site/content/docs/arch.md

@@ -128,8 +128,9 @@ sudo ufw allow punktfunk-web
 sudo firewall-cmd --permanent --add-service=punktfunk-web && sudo firewall-cmd --reload  # firewalld
 ```
 
-That opens **TCP 47992** (HTTPS, login-gated). The mgmt API (47990) stays loopback-only and is never
-opened. Full port lists (`nftables`, explicit ports) are in
+That opens **TCP 47992** (HTTPS, login-gated). The mgmt API (47990) is opened for paired clients by the
+`punktfunk-native` profile (game-library browsing over mTLS); off-loopback it serves only read-only
+status/library, and every admin action stays loopback-only. Full port lists (`nftables`, explicit ports) are in
 [`packaging/arch/README.md`](https://git.unom.io/unom/punktfunk/src/branch/main/packaging/arch/README.md#firewall).
 
 ## 6. Connect a client

docs-site/content/docs/host-cli.md

@@ -32,15 +32,19 @@ punktfunk-host serve --gamestream
 | `--native` | No-op. The native `punktfunk/1` server always runs in `serve`; kept only for backward compatibility. |
 | `--native-port <PORT>` | Native QUIC port (default `9777`). |
 | `--open` | Don't require pairing — serve any device on the network. Off by default; only for trusted single-user setups. |
-| `--mgmt-bind <IP:PORT>` | Management API address (default loopback `127.0.0.1:47990`). |
+| `--mgmt-bind <IP:PORT>` | Management API address (default `0.0.0.0:47990` — all interfaces, so paired clients can browse the game library over mTLS; pass `127.0.0.1:47990` to keep it loopback-only). |
 | `--mgmt-token <TOKEN>` | Override the bearer token for the management API. |
 
 These are the only flags `serve` accepts.
 
-The management API is **always HTTPS with bearer-token auth**. If you don't pass `--mgmt-token`, a token
-is auto-generated and persisted to `~/.config/punktfunk/mgmt-token`; `--mgmt-token` only overrides it. A
-token is **required** when you bind the API off loopback with `--mgmt-bind`. Every endpoint is documented
-in the interactive [**API Reference**](/api).
+The management API is **always HTTPS**. It binds all interfaces by default so a **paired client** can
+fetch the game library over its mTLS certificate — but off loopback that certificate reaches only the
+read-only status + library endpoints. The **admin surface** (arming pairing, removing devices, session
+control, library edits) authenticates with a **bearer token** and is honored **from loopback only**, so
+it is never LAN-exposed even under the default wide bind. If you don't pass `--mgmt-token`, a token is
+auto-generated and persisted to `~/.config/punktfunk/mgmt-token` (the bundled web console reads the same
+file); `--mgmt-token` only overrides it. Pass `--mgmt-bind 127.0.0.1:47990` to keep 47990 loopback-only.
+Every endpoint is documented in the interactive [**API Reference**](/api).
 
 By default the host **requires pairing** — see [Pairing & Trust](/docs/pairing). On `serve` you
 **arm pairing from the web console** (or mgmt API); the host then displays a 4-digit PIN. Pass `--open` to

docs-site/content/docs/web-console.md

@@ -5,8 +5,9 @@ description: Enable the punktfunk browser console, read or change its login pass
 
 The web console is the browser UI for a punktfunk host — live status, paired devices, and the PIN
 pairing flow. It ships as the **`punktfunk-web`** systemd user unit on Linux and the **`PunktfunkWeb`**
-task on Windows, and serves on **`http://<host-ip>:47992`**. The host's own management API stays
-loopback-only behind it, so the console is the one surface you expose on the LAN.
+task on Windows, and serves on **`http://<host-ip>:47992`**. It's the surface you expose on the LAN to
+administer the host; the host's own management API (47990) keeps every admin action loopback-only and
+off-loopback serves only read-only status + game-library browsing to paired clients.
 
 > New here? Read [Security & Safe Use](/docs/security) first — a streaming host is remote control of
 > the machine, so keep it on a trusted LAN or VPN and require pairing.

docs-site/content/docs/windows-host.md

@@ -76,7 +76,7 @@ only by Administrators and SYSTEM. To read or change it (with the `schtasks` res
 
 The host **requires PIN pairing** by default (secure on a LAN). To connect the first time, open the
 console from any browser on the LAN, log in, go to **Devices → [arm pairing](/docs/web-console#arm-pairing)**,
-and enter the PIN on your [client](/docs/clients). The host's own management API stays loopback-only behind the console.
+and enter the PIN on your [client](/docs/clients). The host's own management API keeps every admin action loopback-only; off-loopback it serves only read-only status and game-library browsing to paired clients.
 
 ### Configure