feat(windows-host): bundle + auto-run the web console in the installer

The Windows host installer shipped only the host exe + SudoVDA driver + FFmpeg, so a
fresh install had no web management console — required for basically every user (status,
paired devices, the PIN pairing flow). The console was only ever set up by hand on the
dev box (build-web.ps1 + a hand-made PunktfunkWeb task whose web-run.cmd wasn't even
committed). Bundle it into the same installer, mirroring the proven Linux punktfunk-web
deploy.

- windows-host.yml builds the Nitro node-server console (bun, deb.yml's shape) + fetches
  a pinned portable Node, smoke-boots it under node (/login == 200) to gate the build, and
  hands web/.output + node.exe to the pack script.
- pack-host-installer.ps1 gains -WebDir/-NodeExe and stages the .output tree, node, and
  the two new scripts into the non-WOW64-redirected build area.
- punktfunk-host.iss lays the payload into {app}\web\.output + {app}\node\node.exe, adds
  a wizard page for the console login password pre-filled with a crypto-random default
  (shown on the finish page; kept on upgrade), and runs web-setup.ps1.
- web-setup.ps1 writes the ACL'd %ProgramData%\punktfunk\web-password (Administrators +
  SYSTEM), registers the PunktfunkWeb scheduled task (boot, SYSTEM, restart-on-failure ->
  web-run.cmd -> node on :3000), opens inbound TCP 3000, and starts it. web-run.cmd
  sources the host's mgmt-token + the password and runs the bundled node.
- The console proxies the host's loopback mgmt API with the host's own
  %ProgramData%\punktfunk\mgmt-token (no host-code change). Uninstall removes the task +
  firewall rule.

Validated locally: bun build -> node-server bundle, node boot serves /login (200) and
gates /api (401). The Windows-only bits (ISCC compile, scheduled task, password page,
firewall) validate on the Windows runner CI + on-glass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packaging/windows/README.md

@@ -33,12 +33,23 @@ exe into `C:\Program Files\punktfunk\` and calls that subcommand, elevated.
   display without it).
 - Runs `punktfunk-host service install` (idempotent; writes a default `host.env` only if absent, so
   user config survives upgrades) and, by the *Start service now* task, `service start`.
+- **Web management console** (bundled when packed with `-WebDir`/`-NodeExe`, which the CI always is):
+  lays down the built `.output` server + a portable Node, prompts for a console login password
+  (pre-filled with a secure random default, shown again on the final page; kept on upgrade), then
+  `web-setup.ps1` writes the ACL'd `%ProgramData%\punktfunk\web-password`, registers the
+  **`PunktfunkWeb`** scheduled task (boot, SYSTEM, restart-on-failure → `web-run.cmd` → `node` on
+  `:3000`), opens TCP 3000, and starts it. It proxies the host's loopback mgmt API with the host's
+  own `%ProgramData%\punktfunk\mgmt-token`.
 - **Upgrade:** stops a running `PunktfunkHost` service and waits for `STOPPED` before replacing files
-  (otherwise the locked exe / respawning supervisor would block the copy), then re-points the service.
+  (otherwise the locked exe / respawning supervisor would block the copy), then re-points the service;
+  the existing console password is kept (the wizard page is skipped).
 - **Uninstall** (Add/Remove Programs): runs `service uninstall` (stop + delete service + remove
-  firewall rules). The SudoVDA driver is intentionally left installed.
+  firewall rules) and removes the `PunktfunkWeb` task + its firewall rule. The SudoVDA driver and the
+  `%ProgramData%\punktfunk` config (incl. `web-password`) are intentionally left in place.
 
-Silent install: `punktfunk-host-setup-<ver>.exe /VERYSILENT` (omit the driver with `/MERGETASKS="!installdriver"`).
+Silent install: `punktfunk-host-setup-<ver>.exe /VERYSILENT` (omit the driver with
+`/MERGETASKS="!installdriver"`). A silent fresh install uses the generated random console password —
+read it from `%ProgramData%\punktfunk\web-password`.
 
 ## Prerequisites on the target box
 
@@ -52,9 +63,11 @@ Silent install: `punktfunk-host-setup-<ver>.exe /VERYSILENT` (omit the driver wi
 | File | Role |
 |------|------|
 | `punktfunk-host.iss` | Inno Setup script (the installer definition). |
-| `pack-host-installer.ps1` | Orchestrator: cert + sign, stage the driver bundle, run ISCC, sign setup.exe, emit registry paths. |
+| `pack-host-installer.ps1` | Orchestrator: cert + sign, stage the driver + FFmpeg + **web console** (`.output` + node) bundles, run ISCC, sign setup.exe, emit registry paths. |
 | `stage-sudovda.ps1` | Stage the **vendored** SudoVDA driver + fetch/verify the **pinned** nefcon release into the bundle. |
 | `install-sudovda.ps1` | Runs at install time (elevated): trust cert → gated device-node create → `pnputil` install. |
+| `../../scripts/windows/web-run.cmd` | The `PunktfunkWeb` task action: loads the mgmt token + login password env, runs the bundled `node` on the Nitro server (`:3000`). |
+| `../../scripts/windows/web-setup.ps1` | Install-time (elevated): write the ACL'd console password, register the `PunktfunkWeb` task + firewall rule, start it. |
 | `sudovda/` | **Vendored** prebuilt SudoVDA driver: `SudoVDA.inf` / `sudovda.cat` / `SudoVDA.dll` / `sudovda.cer`. |
 | `nvenc/nvenc.def`, `nvenc/gen-nvenc-importlib.ps1` | Synthesise `nvencodeapi.lib` for the `--features nvenc` link (llvm-dlltool / lib.exe). |