feat(host): --no-mdns/PUNKTFUNK_MDNS gate + punktfunk1-host --pairing-pin — docker-testing enablers

mDNS advertisement (native _punktfunk._udp AND GameStream _nvstream) can now
be disabled with --no-mdns on serve/punktfunk1-host or PUNKTFUNK_MDNS=0
(the PUNKTFUNK_ZEROCOPY off-grammar) — for multicast-dead environments
(bridged Docker, CI netns) where the advert reaches nobody or fails outright
and aborts the GameStream plane; clients dial a manually-added host instead
(mDNS-blind host-add works since the 0.8.4 dial-first fix). Unit tests no
longer advertise on the LAN (mdns: false).

punktfunk1-host gains --pairing-pin <PIN> (the already-plumbed fixed-PIN
test seam, now CLI-exposed; empty refused like --mgmt-token) so a CI harness
runs a deterministic SPAKE2 ceremony instead of scraping the logged PIN.

Verified live: --no-mdns + PUNKTFUNK_MDNS=0 skip the advert, --pairing-pin
arms with the fixed PIN, and a punktfunk1-host --source synthetic +
punktfunk-probe loopback run passes verification (60/60 frames, 0 mismatch).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/punktfunk-host/src/punktfunk1.rs

@@ -92,6 +92,10 @@ pub struct Punktfunk1Options {
     /// `PUNKTFUNK_IDLE_TIMEOUT_MS`; clamped to a ≥1s floor with a keep-alive that scales to it so a
     /// live session never false-closes.
     pub idle_timeout: Option<std::time::Duration>,
+    /// Advertise this host over mDNS (`_punktfunk._udp`). Default on; `--no-mdns` /
+    /// `PUNKTFUNK_MDNS=0` turns it off for multicast-dead environments (bridged Docker, CI netns)
+    /// — clients then connect via `--connect HOST:PORT` / a manually-added host, which always works.
+    pub mdns: bool,
 }
 
 /// Bind the per-session data-plane UDP socket, honoring [`Punktfunk1Options::data_port`]. Returns
@@ -183,6 +187,10 @@ pub(crate) struct NativeServe {
     /// Fixed data-plane UDP port (`--data-port` / `PUNKTFUNK_DATA_PORT`); see
     /// [`Punktfunk1Options::data_port`]. `None` = random port + hole-punch (the default).
     pub data_port: Option<u16>,
+    /// Advertise over mDNS (`--no-mdns` / `PUNKTFUNK_MDNS=0` turns it off). Gates the native
+    /// `_punktfunk._udp` advert AND the GameStream `_nvstream` advert — the serve-level knob for
+    /// multicast-dead environments; see [`Punktfunk1Options::mdns`].
+    pub mdns: bool,
 }
 
 /// Options for the native host when the unified `serve --native` runs it: real virtual capture,
@@ -218,6 +226,7 @@ pub(crate) fn native_serve_opts(cfg: &NativeServe) -> Punktfunk1Options {
         paired_store: None,
         data_port: cfg.data_port,
         idle_timeout: idle_timeout_from_env(),
+        mdns: cfg.mdns,
     }
 }
 
@@ -249,7 +258,13 @@ pub(crate) async fn serve(
     // GameStream _nvstream advert; both run in the unified host). Held for the host's lifetime —
     // dropping `_advert` unregisters. Best-effort: a discovery failure must not stop streaming
     // (manual `--connect HOST:PORT` always works), so we log and continue.
-    let _advert = match crate::gamestream::Host::detect() {
+    let _advert = if !opts.mdns {
+        tracing::info!(
+            "mDNS advertisement disabled (--no-mdns / PUNKTFUNK_MDNS) — clients connect by address"
+        );
+        None
+    } else {
+        match crate::gamestream::Host::detect() {
         Ok(h) => crate::discovery::advertise_native(
             &h.hostname,
             h.local_ip,
@@ -266,6 +281,7 @@ pub(crate) async fn serve(
             tracing::warn!(error = %format!("{e:#}"), "host detect for mDNS failed (continuing)");
             None
         }
+        }
     };
 
     // One audio capturer for the whole host lifetime, handed from session to session
@@ -4474,6 +4490,7 @@ mod tests {
                 paired_store: None,
                 data_port: None,
                 idle_timeout: None,
+                mdns: false, // unit tests must not advertise on the LAN
             })
         });
         std::thread::sleep(std::time::Duration::from_millis(500));
@@ -4671,6 +4688,7 @@ mod tests {
                     paired_store: None, // unused: the shared `np` IS the store handle
                     data_port: None,
                     idle_timeout: None,
+                    mdns: false,
                 },
                 0, // no mgmt API in this test → advertise no `mgmt` mDNS port
                 np_host,
@@ -4772,6 +4790,7 @@ mod tests {
                 paired_store: Some(test_paired_path()),
                 data_port: None,
                 idle_timeout: None,
+                mdns: false,
             })
         });
         std::thread::sleep(std::time::Duration::from_millis(500));