feat(host): Apollo-backlog hardening — cert gate, NVENC RFI, media QoS, async injector

A pass over the apollo-comparison backlog (re-verified against current code).
Lands four items end-to-end plus a Windows-DualSense scoping doc.

- #5/#92/#26 — GameStream paired-cert allow-list. tls.rs surfaces the verified
  peer cert to handlers (serve_https + PeerCertFingerprint, now shared with the
  mgmt API instead of duplicated); nvhttp gates /launch /resume /applist /cancel
  on AppState.paired and reports a real PairStatus; save_paired writes atomically
  (temp+rename). Closes the "mTLS accepts any client cert" hole. + regression test.

- #6/#51/#19/#22 — NVENC caps query -> reference-frame invalidation. nvenc.rs
  query_caps probes nvEncGetEncodeCaps (max dims / 10-bit / custom-VBV / RFI),
  rejecting over-range modes and degrading 10-bit->8-bit instead of an opaque
  InvalidParam. New Encoder::invalidate_ref_frames (default false -> caller
  keyframes); the Windows NVENC path implements real RFI (multi-ref DPB +
  nvEncInvalidateRefFrames, dedup + IDR-on-overflow). control.rs decodes the
  0x0301 lost-frame range (Apollo's IDX_INVALIDATE_REF_FRAMES) -> AppState.rfi_range
  -> encode loop, falling back to a keyframe. NOTE: the Windows NVENC impl is
  RTX-box/CI-pending (can't compile on Linux); adversarially reviewed vs the SDK.

- #43/#72 — media socket QoS + buffer growth. New punktfunk_core::transport::qos:
  grow_socket_buffers (factored out the native plane's 32MB SO_SNDBUF growth so the
  GameStream sockets reuse it) + set_media_qos (opt-in PUNKTFUNK_DSCP=1: DSCP CS5
  video / CS6 audio + Linux SO_PRIORITY, Apollo's scheme). Wired into UdpTransport
  and the GameStream video/audio sockets. Windows IP_TOS needs qWAVE (follow-up).

- #8/#45 — GameStream input injection off the ENet service thread. on_receive no
  longer injects inline (a slow inject head-blocked ENet keepalive/retransmit); it
  forwards to a dedicated injector thread. The hardened InjectorService moved from
  punktfunk1 into crate::inject (shared by both planes) + a coalesce step that sums
  adjacent relative-mouse/scroll deltas while preserving button/key/abs ordering.

Docs: re-verified apollo-comparison.md status (22 items already done/obsolete since
the snapshot) + windows-dualsense-scoping.md (ViGEm can't emulate a DualSense; real
DS5 on Windows needs a VHF virtual-HID driver — web-research pass pending).

fmt + clippy -D warnings clean; full workspace test suite green; no C-ABI/OpenAPI drift.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/punktfunk-host/src/gamestream/serverinfo.rs

@@ -3,18 +3,19 @@
 use super::{Host, APP_VERSION, GFE_VERSION, SERVER_CODEC_MODE_SUPPORT};
 
 /// Build the `<root status_code="200">…</root>` serverinfo document. `https` selects the
-/// paired-HTTPS variant (real MAC). Element names are case-sensitive and match what
-/// moonlight-common-c parses.
-pub fn serverinfo_xml(host: &Host, https: bool) -> String {
-    // MAC is hidden over plain HTTP; PairStatus reflects the pairing store once the HTTPS
-    // path carries per-client identity (a hardening follow-up — 0 for now).
+/// paired-HTTPS variant (real MAC); `paired` is whether the HTTPS peer presented a client cert
+/// that is in the paired allow-list (drives `PairStatus`). Element names are case-sensitive and
+/// match what moonlight-common-c parses.
+pub fn serverinfo_xml(host: &Host, https: bool, paired: bool) -> String {
+    // MAC is hidden over plain HTTP (no per-client identity there).
     let mac = if https {
         "01:02:03:04:05:06"
     } else {
         "00:00:00:00:00:00"
     };
-    // Over the mutual-TLS HTTPS port the peer is an authenticated (paired) client.
-    let pair_status = u8::from(https);
+    // PairStatus reflects the real allow-list: 1 only when the HTTPS peer's client-cert
+    // fingerprint is pinned (the nvhttp handler computes `paired`); 0 otherwise (incl. plain HTTP).
+    let pair_status = u8::from(paired);
     let codec_mode_support = codec_mode_support();
     format!(
         r#"<?xml version="1.0" encoding="utf-8"?>
@@ -104,7 +105,7 @@ mod tests {
             http_port: 47989,
             https_port: 47984,
         };
-        let xml = serverinfo_xml(&host, false);
+        let xml = serverinfo_xml(&host, false, false);
         // The mask is the GPU-aware value (NVENC/no-GPU → the static 65793; a VAAPI host →
         // whatever it probes). Assert the XML embeds exactly what `codec_mode_support()` returns,
         // so the test is deterministic regardless of the build host's GPU.