feat(host): --no-mdns/PUNKTFUNK_MDNS gate + punktfunk1-host --pairing-pin — docker-testing enablers

mDNS advertisement (native _punktfunk._udp AND GameStream _nvstream) can now
be disabled with --no-mdns on serve/punktfunk1-host or PUNKTFUNK_MDNS=0
(the PUNKTFUNK_ZEROCOPY off-grammar) — for multicast-dead environments
(bridged Docker, CI netns) where the advert reaches nobody or fails outright
and aborts the GameStream plane; clients dial a manually-added host instead
(mDNS-blind host-add works since the 0.8.4 dial-first fix). Unit tests no
longer advertise on the LAN (mdns: false).

punktfunk1-host gains --pairing-pin <PIN> (the already-plumbed fixed-PIN
test seam, now CLI-exposed; empty refused like --mgmt-token) so a CI harness
runs a deterministic SPAKE2 ceremony instead of scraping the logged PIN.

Verified live: --no-mdns + PUNKTFUNK_MDNS=0 skip the advert, --pairing-pin
arms with the fixed PIN, and a punktfunk1-host --source synthetic +
punktfunk-probe loopback run passes verification (60/60 frames, 0 mismatch).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/punktfunk-host/src/gamestream/mod.rs

@@ -232,8 +232,18 @@ pub fn serve(
         let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();
         let native_opts = crate::punktfunk1::native_serve_opts(&native);
         if gamestream {
-            // Unified host: GameStream compat planes + native + mgmt.
-            let _advert = mdns::advertise(&state.host).context("mDNS advertise")?;
+            // Unified host: GameStream compat planes + native + mgmt. The `_nvstream` advert is
+            // fatal on failure when enabled (Moonlight clients can't find the host without it) —
+            // `--no-mdns` / PUNKTFUNK_MDNS=0 skips it for multicast-dead environments (stock
+            // Moonlight then needs a manually-added host).
+            let _advert = if native.mdns {
+                Some(mdns::advertise(&state.host).context("mDNS advertise")?)
+            } else {
+                tracing::info!(
+                    "GameStream mDNS advertisement disabled (--no-mdns / PUNKTFUNK_MDNS)"
+                );
+                None
+            };
             rtsp::spawn(state.clone()).context("start RTSP server")?;
             control::spawn(state.clone()).context("start ENet control server")?;
             tracing::info!(