feat: M2 — host productionization: app catalog, persistent pairing, quit semantics, systemd (Phase 4)

- gamestream/apps.rs: an app catalog (loaded from ~/.config/lumen/apps.json, with defaults:
  Desktop + gamescope entries when gamescope/steam/vkcube are installed). /applist renders
  it; /launch?appid=N selects the entry; RTSP PLAY resolves it and the stream honors the
  app's compositor + nested command — so a Moonlight client picks "Steam" and gets a
  gamescope session at its native resolution, or "Desktop" for the KWin/GNOME desktop.
- Persistent pairing: the paired-client cert allow-list now survives restarts
  (~/.config/lumen/paired.json), saved on each successful pairing, loaded at boot.
- Quit semantics: /cancel now actually stops the media threads (streaming/audio flags),
  tearing down the per-session virtual output / gamescope process via the capturer's RAII.
- scripts/lumen-host.service (systemd user unit) + scripts/host.env.example (config file
  consumed by it) — the host runs as a managed service instead of an SSH shell.

Smoke-tested: serve boots, /applist serves the catalog (Desktop + vkcube gamescope entry
auto-detected on this box). GNOME backend validation still pending gnome-shell install;
wlroots vdisplay backend deliberately deferred (not in the priority compositor trio).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/lumen-host.service

@@ -0,0 +1,21 @@
+# lumen streaming host — systemd USER unit.
+#
+# Install:
+#   mkdir -p ~/.config/systemd/user && cp scripts/lumen-host.service ~/.config/systemd/user/
+#   cp scripts/host.env.example ~/.config/lumen/host.env   # then edit
+#   systemctl --user daemon-reload && systemctl --user enable --now lumen-host
+#
+# The unit assumes the compositor session (e.g. headless KWin on wayland-kde) is already up;
+# for a fully self-contained appliance, pair it with a kwin_wayland user unit it can After=.
+[Unit]
+Description=lumen GameStream host
+After=pipewire.service
+
+[Service]
+EnvironmentFile=%h/.config/lumen/host.env
+ExecStart=%h/lumen/target/release/lumen-host serve
+Restart=on-failure
+RestartSec=2
+
+[Install]
+WantedBy=default.target