feat: HDR Step-0 colour-metadata transport + security-audit hardening

Two strands, entangled in punktfunk1.rs, committed together (one builds-green tree).

HDR pipeline Step 0 — glass-to-glass colour-metadata transport (docs/hdr-pipeline-plan.md):
- Protocol/ABI: ColorInfo on the Welcome + a 0xCE HdrMeta datagram carry the source colour
  space + HDR10 static mastering metadata (quic.rs, abi.rs connect_ex5 fixing caps=0).
- New platform-independent, unit-tested HDR static-metadata helpers (hdr.rs): chromaticities
  (1/50000), mastering luminance (0.0001 cd/m2), MaxCLL/MaxFALL in HDR10/ST.2086 units.
- Capture/encode hooks (capture.rs, encode.rs set_hdr_meta) + Linux client / probe plumbing.

Security-audit hardening — top 3 from docs/security-review.md, each adversarially verified:
- #1 [HIGH] Secret file permissions. The host key.pem/cert.pem and both trust stores are now
  written owner-only: 0600 + dir 0700 on Unix (mirrors mgmt_token), best-effort
  SYSTEM/Administrators/OWNER-only icacls DACL on Windows (%ProgramData% is Users-readable).
  Closes a local key-disclosure -> host-impersonation gap. New gamestream::{create_private_dir,
  write_secret_file} + a 0600 regression test.
- #2 [HIGH] Native SPAKE2 PIN is single-use. The PIN is consumed the moment the host sends its
  key-confirmation (which lets the client test its one guess), before reading the proof, so any
  completed attempt -- right OR wrong -- disarms the window. A wrong PIN isn't observable
  host-side (the client aborts before sending its proof), so consuming on first attempt is what
  delivers the documented "one online guess" instead of an unbounded brute-force of the static
  4-digit PIN. Test verifies single-use.
- #3 [MEDIUM] RTSP packetSize is bounded ([64,2048] in stream_config) and VideoPacketizer::new
  uses saturating .max(1), killing a PRE-AUTH div-by-zero/underflow panic of the video thread.
  Tests for {0,15,16,17} + out-of-range rejection.

fmt + clippy -D warnings clean; full workspace test suite green (93 host tests).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/punktfunk-host/src/encode/nvenc.rs

@@ -58,6 +58,11 @@ pub struct NvencD3d11Encoder {
     /// `ABGR10` input format + the BT.2020/PQ colour VUI. Derived per-frame from the capture format
     /// (HDR can toggle mid-session); a change re-inits the session.
     hdr: bool,
+    /// The source's static HDR mastering metadata (from the capturer's `GetDesc1`), emitted as
+    /// in-band SEI (`mastering_display_colour_volume` + `content_light_level_info`) on each keyframe
+    /// when `hdr`. `None` = unknown → no SEI (the VUI still signals BT.2020 PQ). Set per-frame via
+    /// [`Encoder::set_hdr_meta`], so a mid-session regrade is picked up on the next keyframe.
+    hdr_meta: Option<punktfunk_core::quic::HdrMeta>,
     /// Registrations of the capturer's input textures, cached by texture raw pointer — NVENC encodes
     /// them in place (no per-frame copy). The cloned `ID3D11Texture2D` keeps each alive until we
     /// unregister it (the capturer may drop its copy on a device recreate before our teardown runs).
@@ -107,6 +112,7 @@ impl NvencD3d11Encoder {
             buffer_fmt: nv::NV_ENC_BUFFER_FORMAT::NV_ENC_BUFFER_FORMAT_ARGB,
             bit_depth,
             hdr: false,
+            hdr_meta: None,
             regs: HashMap::new(),
             next: 0,
             bitstreams: Vec::new(),
@@ -303,16 +309,48 @@ impl NvencD3d11Encoder {
             cfg.encodeCodecConfig.hevcConfig.set_pixelBitDepthMinus8(2); // 10 - 8
         }
 
-        // HDR colour signaling: BT.2020 primaries + SMPTE ST 2084 (PQ) in the HEVC VUI.
+        // HDR colour signaling: BT.2020 primaries + SMPTE ST.2084 (PQ) transfer + BT.2020-NCL
+        // matrix, limited (studio) range — NVENC's RGB→YUV default. HEVC/H.264 carry it in the VUI;
+        // AV1 has NO VUI, so the SAME CICP code points go in the sequence-header colour config
+        // (`colorPrimaries`/`transferCharacteristics`/`matrixCoefficients`/`colorRange`). Without
+        // this a non-HEVC decoder assumes BT.709 SDR → washed-out / colour-shifted HDR.
+        //
+        // This is the per-stream colour *description* only. The static mastering-display (ST.2086)
+        // and content-light (MaxCLL/MaxFALL) metadata — HEVC SEI / AV1 METADATA OBUs — is a
+        // separate follow-up, as is wiring AV1/H.264 to a true 10-bit (Main10) encode (only HEVC
+        // sets Main10 above today).
         if self.hdr {
-            let vui = &mut cfg.encodeCodecConfig.hevcConfig.hevcVUIParameters;
-            vui.videoSignalTypePresentFlag = 1;
-            vui.videoFullRangeFlag = 0; // limited (studio) range — NVENC RGB→YUV default
-            vui.colourDescriptionPresentFlag = 1;
-            vui.colourPrimaries = nv::NV_ENC_VUI_COLOR_PRIMARIES::NV_ENC_VUI_COLOR_PRIMARIES_BT2020;
-            vui.transferCharacteristics =
+            let prim = nv::NV_ENC_VUI_COLOR_PRIMARIES::NV_ENC_VUI_COLOR_PRIMARIES_BT2020;
+            let trc =
                 nv::NV_ENC_VUI_TRANSFER_CHARACTERISTIC::NV_ENC_VUI_TRANSFER_CHARACTERISTIC_SMPTE2084;
-            vui.colourMatrix = nv::NV_ENC_VUI_MATRIX_COEFFS::NV_ENC_VUI_MATRIX_COEFFS_BT2020_NCL;
+            let mat = nv::NV_ENC_VUI_MATRIX_COEFFS::NV_ENC_VUI_MATRIX_COEFFS_BT2020_NCL;
+            match self.codec {
+                Codec::H265 => {
+                    let vui = &mut cfg.encodeCodecConfig.hevcConfig.hevcVUIParameters;
+                    vui.videoSignalTypePresentFlag = 1;
+                    vui.videoFullRangeFlag = 0;
+                    vui.colourDescriptionPresentFlag = 1;
+                    vui.colourPrimaries = prim;
+                    vui.transferCharacteristics = trc;
+                    vui.colourMatrix = mat;
+                }
+                Codec::H264 => {
+                    let vui = &mut cfg.encodeCodecConfig.h264Config.h264VUIParameters;
+                    vui.videoSignalTypePresentFlag = 1;
+                    vui.videoFullRangeFlag = 0;
+                    vui.colourDescriptionPresentFlag = 1;
+                    vui.colourPrimaries = prim;
+                    vui.transferCharacteristics = trc;
+                    vui.colourMatrix = mat;
+                }
+                Codec::Av1 => {
+                    let av1 = &mut cfg.encodeCodecConfig.av1Config;
+                    av1.colorPrimaries = prim;
+                    av1.transferCharacteristics = trc;
+                    av1.matrixCoefficients = mat;
+                    av1.colorRange = 0; // studio/limited swing
+                }
+            }
         }
 
         // Reference-frame invalidation: keep a deeper DPB so an invalidated reference can fall back
@@ -636,6 +674,51 @@ impl Encoder for NvencD3d11Encoder {
                 encodePicFlags: flags as u32,
                 ..Default::default()
             };
+
+            // In-band HDR10 SEI on every IDR (a forced keyframe, or the first frame NVENC opens with):
+            // `mastering_display_colour_volume` (ST.2086) + `content_light_level_info` (CEA-861.3),
+            // built from the source display's metadata. Any decoder — incl. stock Moonlight — then
+            // tone-maps from the real grade. HEVC/H.264 carry SEI; AV1 uses metadata OBUs (follow-up).
+            // The scratch buffers must outlive `encode_picture`, so they live in this scope.
+            let is_idr = flags != 0 || pts == 0;
+            let mastering_sei = self
+                .hdr_meta
+                .map(|m| crate::hdr::hevc_mastering_display_sei(&m));
+            let cll_sei = self
+                .hdr_meta
+                .map(|m| crate::hdr::hevc_content_light_level_sei(&m));
+            let mut sei: Vec<nv::NV_ENC_SEI_PAYLOAD> = Vec::new();
+            if is_idr && self.hdr {
+                if let Some(p) = mastering_sei.as_ref() {
+                    sei.push(nv::NV_ENC_SEI_PAYLOAD {
+                        payloadSize: p.len() as u32,
+                        payloadType: crate::hdr::SEI_TYPE_MASTERING_DISPLAY_COLOUR_VOLUME,
+                        payload: p.as_ptr() as *mut u8,
+                    });
+                }
+                if let Some(p) = cll_sei.as_ref() {
+                    sei.push(nv::NV_ENC_SEI_PAYLOAD {
+                        payloadSize: p.len() as u32,
+                        payloadType: crate::hdr::SEI_TYPE_CONTENT_LIGHT_LEVEL_INFO,
+                        payload: p.as_ptr() as *mut u8,
+                    });
+                }
+            }
+            if !sei.is_empty() {
+                // Writing a union field is safe; the pointers/len are read during encode_picture.
+                match self.codec {
+                    Codec::H265 => {
+                        pic.codecPicParams.hevcPicParams.seiPayloadArray = sei.as_mut_ptr();
+                        pic.codecPicParams.hevcPicParams.seiPayloadArrayCnt = sei.len() as u32;
+                    }
+                    Codec::H264 => {
+                        pic.codecPicParams.h264PicParams.seiPayloadArray = sei.as_mut_ptr();
+                        pic.codecPicParams.h264PicParams.seiPayloadArrayCnt = sei.len() as u32;
+                    }
+                    // AV1 mastering/CLL ride METADATA OBUs, not SEI — separate follow-up.
+                    Codec::Av1 => {}
+                }
+            }
             (API.encode_picture)(self.encoder, &mut pic)
                 .result_without_string()
                 .map_err(|e| anyhow!("encode_picture: {e:?}"))?;
@@ -649,6 +732,12 @@ impl Encoder for NvencD3d11Encoder {
         self.force_kf = true;
     }
 
+    fn set_hdr_meta(&mut self, meta: Option<punktfunk_core::quic::HdrMeta>) {
+        // Stored and emitted as in-band SEI on the next keyframe (see `submit`). Cheap to call every
+        // frame; only changes when the source is regraded or HDR toggles.
+        self.hdr_meta = meta;
+    }
+
     fn invalidate_ref_frames(&mut self, first: i64, last: i64) -> bool {
         // No live session, the GPU can't invalidate, or a nonsense range → caller forces a full IDR.
         // (NVENC handles are single-threaded; this runs on the encode thread, like submit/poll.)