feat(windows-host): bundle + auto-run the web console in the installer

The Windows host installer shipped only the host exe + SudoVDA driver + FFmpeg, so a
fresh install had no web management console — required for basically every user (status,
paired devices, the PIN pairing flow). The console was only ever set up by hand on the
dev box (build-web.ps1 + a hand-made PunktfunkWeb task whose web-run.cmd wasn't even
committed). Bundle it into the same installer, mirroring the proven Linux punktfunk-web
deploy.

- windows-host.yml builds the Nitro node-server console (bun, deb.yml's shape) + fetches
  a pinned portable Node, smoke-boots it under node (/login == 200) to gate the build, and
  hands web/.output + node.exe to the pack script.
- pack-host-installer.ps1 gains -WebDir/-NodeExe and stages the .output tree, node, and
  the two new scripts into the non-WOW64-redirected build area.
- punktfunk-host.iss lays the payload into {app}\web\.output + {app}\node\node.exe, adds
  a wizard page for the console login password pre-filled with a crypto-random default
  (shown on the finish page; kept on upgrade), and runs web-setup.ps1.
- web-setup.ps1 writes the ACL'd %ProgramData%\punktfunk\web-password (Administrators +
  SYSTEM), registers the PunktfunkWeb scheduled task (boot, SYSTEM, restart-on-failure ->
  web-run.cmd -> node on :3000), opens inbound TCP 3000, and starts it. web-run.cmd
  sources the host's mgmt-token + the password and runs the bundled node.
- The console proxies the host's loopback mgmt API with the host's own
  %ProgramData%\punktfunk\mgmt-token (no host-code change). Uninstall removes the task +
  firewall rule.

Validated locally: bun build -> node-server bundle, node boot serves /login (200) and
gates /api (401). The Windows-only bits (ISCC compile, scheduled task, password page,
firewall) validate on the Windows runner CI + on-glass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/windows/README.md

@@ -32,14 +32,28 @@ Stops `PunktfunkHost`, backs up the current binary (`punktfunk-host.exe.bak`), b
 service on the new binary — **with automatic rollback** if the build fails or the new binary
 won't start. The service is down only for the build duration.
 
-## Rebuild + restart the web console
+## Web management console
+
+On an **installed** host (the `setup.exe`) the console is set up automatically — no manual steps.
+The installer bundles the built `.output` server + a portable Node and runs
+`scripts\windows\web-setup.ps1`, which registers the **`PunktfunkWeb`** scheduled task (at boot, as
+SYSTEM, restart-on-failure) running `{app}\web\web-run.cmd` → `node …\.output\server\index.mjs` on
+`:3000`, opens inbound TCP 3000, and writes the login password to
+`%ProgramData%\punktfunk\web-password` (ACL'd to Administrators + SYSTEM). The mgmt bearer token it
+proxies with is the host's own `%ProgramData%\punktfunk\mgmt-token`. Browse `http://<host-ip>:3000`
+and log in with the password the installer shows on its final page. To change it, edit
+`web-password` and re-run the task: `schtasks /run /tn PunktfunkWeb`.
+
+### Rebuild + restart the console (dev box)
 
 ```powershell
 powershell -ExecutionPolicy Bypass -File scripts\windows\build-web.ps1
 ```
 
 `bun install && bun run build`, installs the externalized server deps into `.output/server`
-(with the `@unom` `.npmrc`), then restarts the `PunktfunkWeb` task and checks `:3000/login`.
+(with the `@unom` `.npmrc`), then restarts the `PunktfunkWeb` task and checks `:3000/login`. Use
+this to iterate on the console against an installed host — `web-setup.ps1` (or a fresh install) is
+what creates the task in the first place.
 
 ## Typical flow after pulling new code
 

scripts/windows/web-run.cmd

@@ -0,0 +1,40 @@
+@echo off
+rem punktfunk web console launcher — the action the PunktfunkWeb scheduled task runs at boot.
+rem
+rem Lays out next to the installed payload: {app}\web\web-run.cmd, {app}\web\.output\... and
+rem {app}\node\node.exe (so %~dp0 = {app}\web\). Auto-wires the console the same way the Linux
+rem systemd unit does: it sources the host's mgmt bearer token + the console login password from
+rem %ProgramData%\punktfunk\, points the /api proxy at the host's loopback HTTPS mgmt API, and runs
+rem the Nitro/Node server on :3000. No env editing on a packaged install.
+setlocal EnableExtensions
+
+set "PFDATA=%ProgramData%\punktfunk"
+set "TOKENFILE=%PFDATA%\mgmt-token"
+set "PWFILE=%PFDATA%\web-password"
+
+rem The host's `serve` writes the mgmt token on first run. Until it exists the proxy has no
+rem credential, so fail and let the task's restart-on-failure retry (mirrors the Linux unit's
+rem Restart=on-failure waiting for the host to create it).
+if not exist "%TOKENFILE%" (
+  echo [punktfunk-web] mgmt token not present yet at "%TOKENFILE%" - waiting for the host service.
+  exit /b 1
+)
+
+rem Both files are single KEY=VALUE lines (LF), written 0600/ACL'd: PUNKTFUNK_MGMT_TOKEN=... and
+rem PUNKTFUNK_UI_PASSWORD=... . Split on the first '=' and import each into the environment.
+for /f "usebackq tokens=1* delims==" %%A in ("%TOKENFILE%") do set "%%A=%%B"
+if exist "%PWFILE%" for /f "usebackq tokens=1* delims==" %%A in ("%PWFILE%") do set "%%A=%%B"
+
+rem Fixed deployment wiring (the Windows analogue of scripts/punktfunk-web.service).
+set "PORT=3000"
+set "HOST=0.0.0.0"
+set "PUNKTFUNK_MGMT_URL=https://127.0.0.1:47990"
+set "NODE_TLS_REJECT_UNAUTHORIZED=0"
+
+set "NODE=%~dp0..\node\node.exe"
+set "SERVER=%~dp0.output\server\index.mjs"
+if not exist "%NODE%" (
+  echo [punktfunk-web] bundled node runtime missing at "%NODE%".
+  exit /b 1
+)
+"%NODE%" "%SERVER%"

scripts/windows/web-setup.ps1

@@ -0,0 +1,93 @@
+<#
+  Provision the punktfunk web console after the host installer has laid down its payload
+  ({app}\web\.output, {app}\node\node.exe, {app}\web\web-run.cmd). Invoked elevated from the
+  installer's [Run] section; idempotent (safe to re-run on upgrade).
+
+    1. Sets the console login password file %ProgramData%\punktfunk\web-password
+       (PUNKTFUNK_UI_PASSWORD=...), ACL'd to Administrators + SYSTEM only:
+         - if -PasswordFile points at a non-empty temp file (a FRESH install collected one on the
+           wizard page), use that;
+         - else if the file already exists (UPGRADE), keep it untouched;
+         - else generate a random one (fallback, so the console never boots auth-misconfigured).
+    2. Registers the PunktfunkWeb scheduled task: at boot, as SYSTEM/Highest, restart-on-failure,
+       no execution time limit (a long-running server), running {app}\web\web-run.cmd.
+    3. Opens inbound TCP 3000 (the console port) on all profiles.
+    4. Waits briefly for the host's mgmt token, then starts the task.
+
+  The mgmt bearer token is NOT managed here — the host owns %ProgramData%\punktfunk\mgmt-token
+  (crates/punktfunk-host/src/mgmt_token.rs writes it on `serve`); web-run.cmd sources it.
+#>
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory = $true)][string]$AppDir,   # the installer's {app}
+    [string]$PasswordFile                            # temp file with the chosen password (fresh install)
+)
+$ErrorActionPreference = 'Stop'
+
+$TaskName = 'PunktfunkWeb'
+$dataDir = Join-Path $env:ProgramData 'punktfunk'
+$pwFile = Join-Path $dataDir 'web-password'
+$tokenFile = Join-Path $dataDir 'mgmt-token'
+New-Item -ItemType Directory -Force -Path $dataDir | Out-Null
+
+function New-RandomPassword {
+    # URL/shell-safe (no /+=) so it's a clean env-file value and cmd-token, like scripts/web-init.sh.
+    $bytes = New-Object byte[] 24
+    ([System.Security.Cryptography.RandomNumberGenerator]::Create()).GetBytes($bytes)
+    $s = [Convert]::ToBase64String($bytes) -replace '[/+=]', ''
+    return $s.Substring(0, [Math]::Min(20, $s.Length))
+}
+
+# --- 1. login password -----------------------------------------------------------------------
+$password = $null
+if ($PasswordFile -and (Test-Path -LiteralPath $PasswordFile)) {
+    $password = (Get-Content -LiteralPath $PasswordFile -Raw).Trim()
+}
+if (-not $password) {
+    if (Test-Path -LiteralPath $pwFile) {
+        Write-Host "keeping existing web console password ($pwFile)"
+    }
+    else {
+        $password = New-RandomPassword
+        Write-Host "no password supplied - generated a random web console password"
+    }
+}
+if ($password) {
+    # LF, no BOM (UTF8) so web-run.cmd's `for /f` reads a clean value.
+    [IO.File]::WriteAllText($pwFile, "PUNKTFUNK_UI_PASSWORD=$password`n")
+    # Lock it down: drop inheritance, grant only Administrators (S-1-5-32-544) + SYSTEM (S-1-5-18).
+    & icacls $pwFile /inheritance:r /grant:r '*S-1-5-32-544:F' '*S-1-5-18:F' | Out-Null
+}
+
+# --- 2. PunktfunkWeb scheduled task ----------------------------------------------------------
+$cmd = Join-Path $AppDir 'web\web-run.cmd'
+if (-not (Test-Path -LiteralPath $cmd)) { throw "web launcher missing: $cmd" }
+$action = New-ScheduledTaskAction -Execute $cmd
+$trigger = New-ScheduledTaskTrigger -AtStartup
+$principal = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount -RunLevel Highest
+# RestartCount/Interval cover transient crashes + the brief post-install race before the host has
+# written the mgmt token (web-run.cmd exits non-zero until then). No time limit: it's a server.
+$settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries `
+    -StartWhenAvailable -RestartInterval (New-TimeSpan -Minutes 1) -RestartCount 10 `
+    -ExecutionTimeLimit (New-TimeSpan -Seconds 0)
+Register-ScheduledTask -TaskName $TaskName -Action $action -Trigger $trigger -Principal $principal `
+    -Settings $settings -Description 'punktfunk web management console (Nitro/Node SSR on :3000)' `
+    -Force | Out-Null
+Write-Host "registered scheduled task $TaskName -> $cmd"
+
+# --- 3. firewall: inbound TCP 3000 -----------------------------------------------------------
+try {
+    $fwName = 'PunktfunkWeb-TCP-3000'
+    Get-NetFirewallRule -Name $fwName -ErrorAction SilentlyContinue | Remove-NetFirewallRule -ErrorAction SilentlyContinue
+    New-NetFirewallRule -Name $fwName -DisplayName 'punktfunk web console (TCP 3000)' `
+        -Direction Inbound -Action Allow -Protocol TCP -LocalPort 3000 -Profile Any | Out-Null
+    Write-Host "firewall: allowed inbound TCP 3000"
+}
+catch { Write-Warning "could not add the firewall rule for TCP 3000: $($_.Exception.Message)" }
+
+# --- 4. wait for the host's mgmt token, then start -------------------------------------------
+# The host service was installed+started just before this; give it a moment to write the token so
+# the first start serves immediately (otherwise restart-on-failure picks it up within a minute).
+for ($i = 0; $i -lt 30 -and -not (Test-Path -LiteralPath $tokenFile); $i++) { Start-Sleep -Seconds 1 }
+Start-ScheduledTask -TaskName $TaskName
+Write-Host "started $TaskName (console on http://<host-ip>:3000)"