feat: M2 — host productionization: app catalog, persistent pairing, quit semantics, systemd (Phase 4)

- gamestream/apps.rs: an app catalog (loaded from ~/.config/lumen/apps.json, with defaults:
  Desktop + gamescope entries when gamescope/steam/vkcube are installed). /applist renders
  it; /launch?appid=N selects the entry; RTSP PLAY resolves it and the stream honors the
  app's compositor + nested command — so a Moonlight client picks "Steam" and gets a
  gamescope session at its native resolution, or "Desktop" for the KWin/GNOME desktop.
- Persistent pairing: the paired-client cert allow-list now survives restarts
  (~/.config/lumen/paired.json), saved on each successful pairing, loaded at boot.
- Quit semantics: /cancel now actually stops the media threads (streaming/audio flags),
  tearing down the per-session virtual output / gamescope process via the capturer's RAII.
- scripts/lumen-host.service (systemd user unit) + scripts/host.env.example (config file
  consumed by it) — the host runs as a managed service instead of an SSH shell.

Smoke-tested: serve boots, /applist serves the catalog (Desktop + vkcube gamescope entry
auto-detected on this box). GNOME backend validation still pending gnome-shell install;
wlroots vdisplay backend deliberately deferred (not in the priority compositor trio).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/host.env.example

@@ -0,0 +1,22 @@
+# lumen host configuration (~/.config/lumen/host.env) — consumed by lumen-host.service.
+
+# Session / compositor environment (headless KWin example).
+XDG_RUNTIME_DIR=/run/user/1000
+DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus
+WAYLAND_DISPLAY=wayland-kde
+XDG_CURRENT_DESKTOP=KDE
+
+# Video source: `virtual` creates a per-client virtual output at the client's exact
+# resolution+refresh (the flagship mode); `portal` captures an existing monitor.
+LUMEN_VIDEO_SOURCE=virtual
+
+# GPU zero-copy capture (EGL/Vulkan → CUDA → NVENC). Falls back to CPU automatically.
+LUMEN_ZEROCOPY=1
+
+# Optional overrides (apps.json is the primary mechanism for per-app settings):
+#LUMEN_COMPOSITOR=kwin          # kwin | mutter | gamescope | wlroots
+#LUMEN_GAMESCOPE_APP=vkcube     # nested command for ad-hoc gamescope sessions
+#LUMEN_INPUT_BACKEND=libei      # wlr | libei | gamescope | uinput
+#LUMEN_FEC_PCT=20               # video FEC overhead percent
+#LUMEN_PERF=1                   # per-stage timing logs
+#RUST_LOG=info