feat(windows-host): bundle + auto-run the web console in the installer

The Windows host installer shipped only the host exe + SudoVDA driver + FFmpeg, so a
fresh install had no web management console — required for basically every user (status,
paired devices, the PIN pairing flow). The console was only ever set up by hand on the
dev box (build-web.ps1 + a hand-made PunktfunkWeb task whose web-run.cmd wasn't even
committed). Bundle it into the same installer, mirroring the proven Linux punktfunk-web
deploy.

- windows-host.yml builds the Nitro node-server console (bun, deb.yml's shape) + fetches
  a pinned portable Node, smoke-boots it under node (/login == 200) to gate the build, and
  hands web/.output + node.exe to the pack script.
- pack-host-installer.ps1 gains -WebDir/-NodeExe and stages the .output tree, node, and
  the two new scripts into the non-WOW64-redirected build area.
- punktfunk-host.iss lays the payload into {app}\web\.output + {app}\node\node.exe, adds
  a wizard page for the console login password pre-filled with a crypto-random default
  (shown on the finish page; kept on upgrade), and runs web-setup.ps1.
- web-setup.ps1 writes the ACL'd %ProgramData%\punktfunk\web-password (Administrators +
  SYSTEM), registers the PunktfunkWeb scheduled task (boot, SYSTEM, restart-on-failure ->
  web-run.cmd -> node on :3000), opens inbound TCP 3000, and starts it. web-run.cmd
  sources the host's mgmt-token + the password and runs the bundled node.
- The console proxies the host's loopback mgmt API with the host's own
  %ProgramData%\punktfunk\mgmt-token (no host-code change). Uninstall removes the task +
  firewall rule.

Validated locally: bun build -> node-server bundle, node boot serves /login (200) and
gates /api (401). The Windows-only bits (ISCC compile, scheduled task, password page,
firewall) validate on the Windows runner CI + on-glass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/windows/web-run.cmd

@@ -0,0 +1,40 @@
+@echo off
+rem punktfunk web console launcher — the action the PunktfunkWeb scheduled task runs at boot.
+rem
+rem Lays out next to the installed payload: {app}\web\web-run.cmd, {app}\web\.output\... and
+rem {app}\node\node.exe (so %~dp0 = {app}\web\). Auto-wires the console the same way the Linux
+rem systemd unit does: it sources the host's mgmt bearer token + the console login password from
+rem %ProgramData%\punktfunk\, points the /api proxy at the host's loopback HTTPS mgmt API, and runs
+rem the Nitro/Node server on :3000. No env editing on a packaged install.
+setlocal EnableExtensions
+
+set "PFDATA=%ProgramData%\punktfunk"
+set "TOKENFILE=%PFDATA%\mgmt-token"
+set "PWFILE=%PFDATA%\web-password"
+
+rem The host's `serve` writes the mgmt token on first run. Until it exists the proxy has no
+rem credential, so fail and let the task's restart-on-failure retry (mirrors the Linux unit's
+rem Restart=on-failure waiting for the host to create it).
+if not exist "%TOKENFILE%" (
+  echo [punktfunk-web] mgmt token not present yet at "%TOKENFILE%" - waiting for the host service.
+  exit /b 1
+)
+
+rem Both files are single KEY=VALUE lines (LF), written 0600/ACL'd: PUNKTFUNK_MGMT_TOKEN=... and
+rem PUNKTFUNK_UI_PASSWORD=... . Split on the first '=' and import each into the environment.
+for /f "usebackq tokens=1* delims==" %%A in ("%TOKENFILE%") do set "%%A=%%B"
+if exist "%PWFILE%" for /f "usebackq tokens=1* delims==" %%A in ("%PWFILE%") do set "%%A=%%B"
+
+rem Fixed deployment wiring (the Windows analogue of scripts/punktfunk-web.service).
+set "PORT=3000"
+set "HOST=0.0.0.0"
+set "PUNKTFUNK_MGMT_URL=https://127.0.0.1:47990"
+set "NODE_TLS_REJECT_UNAUTHORIZED=0"
+
+set "NODE=%~dp0..\node\node.exe"
+set "SERVER=%~dp0.output\server\index.mjs"
+if not exist "%NODE%" (
+  echo [punktfunk-web] bundled node runtime missing at "%NODE%".
+  exit /b 1
+)
+"%NODE%" "%SERVER%"