feat: punktfunk/1 — mid-stream mode renegotiation + PIN pairing ceremony

Renegotiation (no reconnect on resize): the handshake bi-stream stays open; the client
sends Reconfigure{mode} (typed post-handshake message), the host validates + acks
Reconfigured and rebuilds capture/encoder/virtual output at the new mode while the data
plane (keys, ports, FEC) runs untouched — the first new-mode AU is an IDR with in-band
parameter sets. NativeClient::request_mode / punktfunk_connection_request_mode; mode()
reflects the active mode. Validated live on KWin: one continuous stream, 225 frames
@1280x720 then 395 @1920x1080, ~90 ms pipeline rebuild (ffprobe shows both resolutions).

PIN pairing (mutual trust, kills TOFU MITM): clients get persistent self-signed
identities presented via QUIC client auth (generate_identity / client auth offered but
optional server-side — legacy clients still connect). Ceremony on the control stream:
PairRequest{name} → host shows a 4-digit PIN (log) + PairChallenge{salt} → client proves
with HMAC-SHA256(PIN‖salt, client_fp‖host_fp) — binding both certs means a MITM can't
forward a proof, single attempt per PIN, constant-time compare → PairResult; host
persists the fingerprint (~/.config/punktfunk/punktfunk1-paired.json), client pins the
host's. m3-host --require-pairing gates sessions on the paired set.
NativeClient::pair + punktfunk_pair/punktfunk_generate_identity in the ABI; reference
client: --pair PIN --name LABEL + auto-generated persistent identity, --remode for live
renegotiation testing. Swift wrapper: ClientIdentity/generateIdentity()/pair(),
requestMode()/currentMode(); README handoff updated.

Tested: reconfigure/pairing wire roundtrips, C-ABI mode switch ack, full in-process
ceremony (wrong PIN → Crypto, anonymous-vs-gate rejection, success → pinned session);
live wrong-PIN ceremony against the serving host (PIN logged, proof rejected).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

clients/apple/README.md

@@ -117,15 +117,19 @@ signing, bundle id `io.unom.punktfunk`. Notes:
    contract documented on the constructors; the host accumulates them into a virtual
    Xbox 360 pad). Poll `nextRumble()` and feed `GCDeviceHaptics` for force feedback.
    Client-side capture isn't in `InputCapture` yet.
-7. **Trust**: connect once with `pinSHA256: nil` (TOFU), persist `hostFingerprint` keyed
-   by host, pass it on every later connect — a mismatch throws `.connectFailed`. The host
-   logs its fingerprint at startup ("clients pin this fingerprint") for out-of-band
-   verification UX; a PIN-style pairing ceremony is a later punktfunk-core task.
-   `PunktfunkClient` implements exactly this: explicit fingerprint confirmation on first
-   connect (input/cursor capture held back until confirmed), pin stored per host
-   (`HostStore`), "Forget Identity" in the card's context menu for legitimate host
-   reinstalls. Note the OTHER direction is still open: the host authorizes no one — any
-   client that reaches the port gets a session (fine on a LAN, not on the internet).
+7. **Trust — the full ceremony exists now.** `generateIdentity()` once (persist both
+   PEMs in the Keychain), then `pair(host:identity:pin:name:)` with the 4-digit PIN the
+   host displays (its log; UI later) — returns the host's VERIFIED fingerprint; persist
+   it and pass `pinSHA256:` + `identity:` to every connect. A wrong-size pin throws
+   `.invalidPin`, a wrong PIN `.wrongPIN`. The TOFU flow `PunktfunkClient` already
+   implements (fingerprint confirmation sheet, per-host `HostStore`, "Forget Identity")
+   keeps working against hosts not running `--require-pairing`; upgrading the sheet to a
+   PIN-entry field closes the remaining gap — with `--require-pairing` the host now
+   authorizes clients too (the "other direction" is no longer open, opt-in per host).
+7b. **Resize without reconnect**: `requestMode(width:height:refreshHz:)` mid-stream —
+   the host rebuilds at the new mode in ~90 ms; the first new-mode AU is an IDR with
+   fresh parameter sets (the refresh-on-IDR decode flow handles it untouched) and
+   `currentMode()` reflects the switch. Wire it to window-resize events.
 8. **Input capture caveats** (stage 1): GC handlers only fire while the app has focus —
    on focus loss `InputCapture` auto-releases everything still held (keys + buttons) so
    nothing sticks down host-side. While the stream has focus the LOCAL cursor is hidden