feat(clients/windows): single-window handoff, shared settings store, console-UI surfacing

UX polish batch 1 (clients/windows/ui-polish-plan.md, workstreams W0/A1/B/C/E):

- W0: the shell's duplicated trust/settings structs are gone — src/trust.rs
  re-exports pf-client-core's, so the shell and the spawned session binary share
  ONE Settings shape over client-windows-settings.json. Fixes real bugs: the
  shell's saves no longer drop session-side fields; the stats-overlay toggle
  (show_hud -> show_stats, serde alias migrates old files) and the forwarded-
  controller pick now actually reach the spawned session. The "Streaming engine"
  Settings combo is gone (PUNKTFUNK_BUILTIN_STREAM=1 stays as the dev A/B knob).

- Forwarded-controller pinning by stable key (vid:pid:name, pf-client-core's
  format): persisted as forward_pad, applied by the shell's own service at
  startup AND by the session binary in session_params (both OSes — the session
  never applied the pin before).

- A1 single window: the shell hides itself when the spawned session window
  presents its first frame ({"ready":true}) and restores + foregrounds on the
  child's exit — exactly one visible Punktfunk window at any time. Restore runs
  before the request-access cancel gate so a Ready/Cancel race can't strand the
  shell hidden.

- C console UI: punktfunk-session --browse gains --json-status (ready when the
  library window presents; error line on a failed start), and the shell
  surfaces it — "Open console UI" on paired hosts' menus, plus a controller-
  detected hint card targeting the most recent paired host (x64 only; aarch64
  ships no skia ui feature). Browse spawns hide/restore the shell like streams.

- B responsive: minimum window size (420x360); the hosts header collapses to
  icon-only buttons below 700 px; the session status card shrinks instead of
  clipping (max_width); busy pages, help actions, licenses and long labels wrap.

- E polish: session exe gets the app icon (winresource + WM_SETICON via the new
  pf-presenter win32.rs); both exes share an explicit AppUserModelID on
  unpackaged runs (packaged identity wins) so the windows group as one taskbar
  app across the visibility handoff; "Start streams fullscreen" toggle passes
  --fullscreen (GTK parity); connects stamp KnownHost::last_used; the connect
  target is stashed for every route so "Connecting to X" always names the host.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

clients/windows/src/shell_window.rs

@@ -0,0 +1,55 @@
+//! Hide/restore the shell's top-level window around a spawned session, so exactly ONE
+//! Punktfunk window is visible at a time: the spawned stream/browse window IS the app
+//! while it runs (hidden = no taskbar entry, no Alt-Tab ghost), and the shell reappears
+//! the moment the child exits — every exit path funnels through the spawn reader's
+//! `Exited` event (clean end, error, crash, Disconnect kill), so the shell can never stay
+//! hidden with no child.
+//!
+//! windows-reactor exposes no window handle, so the HWND is resolved by its (unique)
+//! title and cached — the same pattern as `app::apply_window_icon_when_ready` and
+//! `stream::window_dpi`.
+
+use std::sync::atomic::{AtomicIsize, Ordering};
+use windows::Win32::Foundation::HWND;
+use windows::Win32::UI::WindowsAndMessaging::{
+    FindWindowW, IsWindow, SetForegroundWindow, ShowWindow, SW_HIDE, SW_SHOW,
+};
+
+static SHELL_HWND: AtomicIsize = AtomicIsize::new(0);
+
+fn shell_hwnd() -> Option<HWND> {
+    unsafe {
+        let cached = SHELL_HWND.load(Ordering::Relaxed);
+        if cached != 0 {
+            let h = HWND(cached as *mut _);
+            if IsWindow(Some(h)).as_bool() {
+                return Some(h);
+            }
+        }
+        let h = FindWindowW(None, windows::core::w!("Punktfunk")).ok()?;
+        SHELL_HWND.store(h.0 as isize, Ordering::Relaxed);
+        Some(h)
+    }
+}
+
+/// Hide the shell while a spawned session window is up. Called on the child's
+/// `{"ready":true}` (its window has presented — never earlier, so a failed connect keeps
+/// the shell in view with its error banner).
+pub(crate) fn hide() {
+    if let Some(h) = shell_hwnd() {
+        unsafe {
+            let _ = ShowWindow(h, SW_HIDE);
+        }
+    }
+}
+
+/// Bring the shell back (and to the foreground) when the child exits. Safe to call when
+/// it was never hidden — showing a visible window is a no-op.
+pub(crate) fn restore() {
+    if let Some(h) = shell_hwnd() {
+        unsafe {
+            let _ = ShowWindow(h, SW_SHOW);
+            let _ = SetForegroundWindow(h);
+        }
+    }
+}