feat(clients/windows): single-window handoff, shared settings store, console-UI surfacing

UX polish batch 1 (clients/windows/ui-polish-plan.md, workstreams W0/A1/B/C/E):

- W0: the shell's duplicated trust/settings structs are gone — src/trust.rs
  re-exports pf-client-core's, so the shell and the spawned session binary share
  ONE Settings shape over client-windows-settings.json. Fixes real bugs: the
  shell's saves no longer drop session-side fields; the stats-overlay toggle
  (show_hud -> show_stats, serde alias migrates old files) and the forwarded-
  controller pick now actually reach the spawned session. The "Streaming engine"
  Settings combo is gone (PUNKTFUNK_BUILTIN_STREAM=1 stays as the dev A/B knob).

- Forwarded-controller pinning by stable key (vid:pid:name, pf-client-core's
  format): persisted as forward_pad, applied by the shell's own service at
  startup AND by the session binary in session_params (both OSes — the session
  never applied the pin before).

- A1 single window: the shell hides itself when the spawned session window
  presents its first frame ({"ready":true}) and restores + foregrounds on the
  child's exit — exactly one visible Punktfunk window at any time. Restore runs
  before the request-access cancel gate so a Ready/Cancel race can't strand the
  shell hidden.

- C console UI: punktfunk-session --browse gains --json-status (ready when the
  library window presents; error line on a failed start), and the shell
  surfaces it — "Open console UI" on paired hosts' menus, plus a controller-
  detected hint card targeting the most recent paired host (x64 only; aarch64
  ships no skia ui feature). Browse spawns hide/restore the shell like streams.

- B responsive: minimum window size (420x360); the hosts header collapses to
  icon-only buttons below 700 px; the session status card shrinks instead of
  clipping (max_width); busy pages, help actions, licenses and long labels wrap.

- E polish: session exe gets the app icon (winresource + WM_SETICON via the new
  pf-presenter win32.rs); both exes share an explicit AppUserModelID on
  unpackaged runs (packaged identity wins) so the windows group as one taskbar
  app across the visibility handoff; "Start streams fullscreen" toggle passes
  --fullscreen (GTK parity); connects stamp KnownHost::last_used; the connect
  target is stashed for every route so "Connecting to X" always names the host.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

clients/session/Cargo.toml

@@ -31,3 +31,8 @@ serde_json = { version = "1", optional = true }
 anyhow = "1"
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
+
+# Embeds the app icon as an exe resource (build.rs) — Windows hosts only (rc.exe from
+# the SDK); same pattern as clients/windows.
+[target.'cfg(windows)'.build-dependencies]
+winresource = "0.1"

clients/session/build.rs

@@ -0,0 +1,19 @@
+//! Embed the Windows version-info + icon resources into `punktfunk-session.exe`. The
+//! icon drives Explorer, and `pf-presenter`'s `win32::stamp_window_icon` loads it by
+//! ordinal 1 onto the SDL window's title bar / taskbar / Alt-Tab (SDL's own window-class
+//! icon is the generic default).
+
+fn main() {
+    // cfg(windows) is the HOST (skips Linux/macOS builds of this cross-platform binary);
+    // CARGO_CFG_WINDOWS is the TARGET (x64 and cross-compiled ARM64 both pass).
+    #[cfg(windows)]
+    if std::env::var_os("CARGO_CFG_WINDOWS").is_some() {
+        let icon = "../../packaging/windows/branding/punktfunk.ico";
+        println!("cargo:rerun-if-changed={icon}");
+        winresource::WindowsResource::new()
+            // Ordinal 1 — pf-presenter's win32.rs loads it by this id for WM_SETICON.
+            .set_icon_with_id(icon, "1")
+            .compile()
+            .expect("embed windows icon resource");
+    }
+}

clients/session/src/browse.rs

@@ -55,11 +55,14 @@ pub fn run(target: &str) -> u8 {
         shared.set_phase(LibraryPhase::PairFirst);
     }
 
+    // `--json-status`: a shell parent is reading stdout (the WinUI shell hides itself on
+    // `{"ready":true}` and restores on exit) — plain CLI/gamescope runs stay silent.
+    let json_status = arg_flag("--json-status");
     let opts = pf_presenter::SessionOpts {
         window_title: format!("Punktfunk · {host_label}"),
         fullscreen: fullscreen_mode(),
         print_stats: settings.show_stats || arg_flag("--stats"),
-        json_status: false, // browse has no shell parent reading stdout
+        json_status,
         on_connected: Some(Box::new(|fingerprint: [u8; 32]| {
             trust::touch_last_used(&trust::hex(&fingerprint));
         })),
@@ -101,6 +104,11 @@ pub fn run(target: &str) -> u8 {
     match result {
         Ok(()) => 0,
         Err(e) => {
+            // The shell contract's terminal line (a clean quit needs none — stdout EOF
+            // already routes the shell back to its host list silently).
+            if json_status {
+                crate::session_main::json_line("error", &format!("{e:#}"), Some(false));
+            }
             eprintln!("browse: {e:#}");
             crate::session_main::EXIT_PRESENTER_FAILED
         }

clients/session/src/main.rs

@@ -94,6 +94,13 @@ mod session_main {
         force_software: Arc<AtomicBool>,
         vulkan: Option<pf_client_core::video::VulkanDecodeDevice>,
     ) -> SessionParams {
+        // Re-apply the shell-persisted forwarded-controller pin (stable `vid:pid:name`
+        // key) to OUR gamepad service — the shells' in-process services can't reach this
+        // process. Applied per params-build (idempotent; browse re-launches included) so
+        // it lands before the session attaches. Empty = automatic (most recent).
+        if !settings.forward_pad.is_empty() {
+            gamepad.set_pinned(Some(settings.forward_pad.clone()));
+        }
         let mode = Mode {
             width: if settings.width == 0 {
                 native.width
@@ -145,8 +152,9 @@ mod session_main {
     }
 
     /// One JSON status line on stdout (the shell parses these; strings hand-escaped via
-    /// the minimal rules a reason string can need).
-    fn json_line(key: &str, msg: &str, trust_rejected: Option<bool>) {
+    /// the minimal rules a reason string can need). `pub(crate)`: browse mode emits its
+    /// failure through the same contract when spawned with `--json-status`.
+    pub(crate) fn json_line(key: &str, msg: &str, trust_rejected: Option<bool>) {
         let escaped: String = msg
             .chars()
             .flat_map(|c| match c {
@@ -243,7 +251,7 @@ mod session_main {
         let Some(target) = arg_value("--connect") else {
             eprintln!(
                 "usage: punktfunk-session --connect host[:port] [--fp HEX] [--launch id] [--fullscreen]\n\
-                 \x20      punktfunk-session --browse host[:port] [--mgmt PORT] [--fullscreen]\n\
+                 \x20      punktfunk-session --browse host[:port] [--mgmt PORT] [--fullscreen] [--json-status]\n\
                  \n\
                  Streams from a paired punktfunk host in a Vulkan window; --browse opens the\n\
                  console game library instead (paired hosts only). Pair first via the\n\