fix(packaging): open mgmt/library port 47990 on the LAN firewall profiles

The mgmt REST API has bound 0.0.0.0:47990 by default since ae51276 so paired
clients can browse the game library over mTLS, but every packaged firewall
opener still excluded 47990 and the docs still claimed it was loopback-only.
On any host with an active firewall (ufw/firewalld) the LAN game-library
feature was silently broken.

Add 47990/tcp to the native firewall profiles (punktfunk.ufw [punktfunk-native]
+ punktfunk-native.xml) and correct the stale "loopback-only by default" text
across the debian/arch/bazzite READMEs and the docs site (incl. the factually
wrong --mgmt-bind default in host-cli.md, 127.0.0.1 -> 0.0.0.0). Opening the
port adds no admin exposure: off-loopback mgmt::require_auth serves only the
read-only status/library allowlist to a paired client cert; the bearer-token
admin surface stays loopback-only regardless of the bind.

Windows was already sound (shared parse_serve binds 0.0.0.0; service.rs already
firewall-opens 47990) — add a clarifying comment so the rule isn't mistaken for
accidental over-exposure.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packaging/arch/README.md

@@ -160,17 +160,20 @@ sudo firewall-cmd --reload
 ```
 
 `punktfunk-gamestream` opens the fixed Moonlight ports + mDNS; `punktfunk-native` opens the QUIC
-control port (UDP 9777) + mDNS. Enable both if the host runs `serve --gamestream` (which serves
-both planes). The **data plane is an *ephemeral* UDP port** the client opens with a hole-punch, so
+control port (UDP 9777) + mDNS + the mgmt/library API (TCP 47990, HTTPS + mTLS). Enable both if the
+host runs `serve --gamestream` (which serves both planes). The **data plane is an *ephemeral* UDP port** the client opens with a hole-punch, so
 there is no fixed data port in either service — the host streams back out through the path the
 client opened, which any firewall that allows outbound UDP (the default) passes. The mgmt REST API
-(TCP 47990) binds to loopback by default — leave it closed unless you move it off loopback with
-`--mgmt-bind IP:PORT` (which then requires `--mgmt-token`).
+(TCP 47990, HTTPS + mTLS) binds all interfaces by default so paired clients can browse the game library
+— the `punktfunk-native` profile opens it. Off-loopback it serves only read-only status/library to a
+paired client cert and keeps the admin surface loopback-only (`--mgmt-bind 127.0.0.1:47990` to opt out).
 
 If you installed the **web console** (`punktfunk-web`) and want it reachable from another device,
 open its port with the matching one-liner — `sudo ufw allow punktfunk-web` or `sudo firewall-cmd
 --permanent --add-service=punktfunk-web && sudo firewall-cmd --reload` — which opens **TCP 47992**
-(HTTPS, login-gated). The mgmt API (47990) stays loopback-only.
+(HTTPS, login-gated). The mgmt API (47990) is opened for paired clients by the `punktfunk-native`
+profile (game-library browsing over mTLS); off-loopback it serves only read-only status/library and
+keeps admin loopback-only.
 
 Prefer explicit rules (or a firewall the shipped profiles don't cover)? Open the ports directly.
 The **native `punktfunk/1`** plane:
@@ -198,13 +201,16 @@ And the **GameStream / Moonlight** ports (fixed) — only needed if you run the
 | 47998–48010 | UDP | Video RTP (+ FEC), ENet control (47999), audio (48000) |
 | 5353 | UDP | mDNS auto-discovery |
 
-The mgmt API (TCP 47990) binds to loopback by default — leave it closed unless you move it off
-loopback with `--mgmt-bind IP:PORT` (which then requires `--mgmt-token`).
+The mgmt API (TCP 47990, HTTPS + mTLS) binds all interfaces by default so paired clients can browse the
+game library — the `punktfunk-native` profile opens it. Off-loopback it serves only read-only
+status/library to a paired client cert; the admin surface stays loopback-only. Pass
+`--mgmt-bind 127.0.0.1:47990` to keep it loopback-only (then leave 47990 closed).
 
 With `ufw` (explicit ports, instead of the shipped `punktfunk-native`/`punktfunk-gamestream` profile):
 
 ```sh
 sudo ufw allow 9777/udp                                 # punktfunk/1 control plane
+sudo ufw allow 47990/tcp                                # mgmt/library API (HTTPS + mTLS; LAN = read-only, paired)
 sudo ufw allow 47984/tcp && sudo ufw allow 47989/tcp && sudo ufw allow 48010/tcp
 sudo ufw allow 47998,47999,48000/udp                    # GameStream video/control/audio
 sudo ufw allow 5353/udp                                 # mDNS discovery
@@ -217,6 +223,7 @@ With raw `nftables` (add to your `inet filter input` chain):
 
 ```
 udp dport 9777 accept                  # punktfunk/1 control plane
+tcp dport 47990 accept                 # mgmt/library API (HTTPS + mTLS; LAN = read-only, paired)
 tcp dport { 47984, 47989, 48010 } accept
 udp dport { 47998-48000, 5353 } accept # GameStream video/control/audio + mDNS
 # The punktfunk/1 data plane is a random UDP port — normally left closed (hole-punch + ~2.5s