feat(apple): surface host online status on the home grid

Saved host cards now show a presence dot — green when the host is advertising on
the LAN right now, grey when not seen. Cross-references each StoredHost against the
live mDNS discovery set (HostDiscovery). No host changes: the host already
advertises _punktfunk._udp with a stable id + cert fingerprint, which the client
already browses.

- StoredHost.matches(DiscoveredHost): fingerprint-first (survives a DHCP address
  change), address:port fallback. The discovered-section dedup now uses the same
  match, so a saved host whose IP changed no longer also shows up as a stranger.
- HostCardView gains an isOnline presence dot (accessibility-labelled).
- HomeView.isOnline recomputes on every @Published discovery change, so the dot
  tracks hosts joining/leaving the network live.

Online detection is LAN-scoped by design: a remote/cross-subnet host that doesn't
advertise here shows grey ("not seen"), not a false "offline". Swift-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

clients/apple/Sources/PunktfunkClient/HostStore.swift

@@ -25,6 +25,26 @@ struct StoredHost: Identifiable, Codable, Hashable {
     var displayName: String { name.isEmpty ? address : name }
 }
 
+extension StoredHost {
+    /// True when a live mDNS advert (`DiscoveredHost`) describes THIS saved host — drives the
+    /// "online" indicator and de-dupes the discovered section. Matched by certificate
+    /// fingerprint when both sides carry it (so it survives a DHCP address change), otherwise
+    /// by address:port. Online detection is LAN-scoped: a host not advertising on this network
+    /// (off, or a remote/cross-subnet address) simply won't match — "not seen", not proven off.
+    func matches(_ discovered: DiscoveredHost) -> Bool {
+        if let pin = pinnedSHA256, let fp = discovered.fingerprintHex,
+           pin.hexLower == fp.lowercased() {
+            return true
+        }
+        return address == discovered.host && port == discovered.port
+    }
+}
+
+private extension Data {
+    /// Lowercase hex, no separators — to compare a pinned fingerprint against the mDNS `fp`.
+    var hexLower: String { map { String(format: "%02x", $0) }.joined() }
+}
+
 @MainActor
 final class HostStore: ObservableObject {
     private static let key = DefaultsKey.hosts