feat: hosts grid + trust-on-first-use UX + settings pane

The app grows from a dev connect form into a real client shell:

- Home is a grid of saved hosts (UserDefaults-persisted; context menu: Remove / Forget
  Identity), "+" in the toolbar opens the add-host sheet, the stream mode moved into
  Settings (⌘, / gear) — native resolution stays the only mode, no scaling.
- Trust is now explicit: the protocol always supported certificate pinning, but the app
  passed no pin and discarded the observed fingerprint — silently trusting any host.
  First connect now shows the host's SHA-256 fingerprint (compare with the "clients pin
  this fingerprint" line in the host log) over the live-but-blurred stream; the stream
  must pump immediately (the opening IDR is the only guaranteed one), so StreamView gains
  a capturesCursor switch to keep the cursor free while the prompt needs clicking, and
  input capture starts only after confirmation. Trusting pins the fingerprint per host;
  a changed host identity then refuses to connect.
- PUNKTFUNK_AUTOCONNECT keeps working (auto-trusts, doesn't touch the saved hosts).

Host→client authorization (pairing PIN) remains a punktfunk-core roadmap item — the host
still accepts any client that can reach its port.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

clients/apple/Sources/PunktfunkClient/PunktfunkClientApp.swift

@@ -1,5 +1,5 @@
-// PunktfunkClient — development app shell around PunktfunkKit (swift run PunktfunkClient).
-// Connect form → StreamView (AVSampleBufferDisplayLayer HEVC) + InputCapture.
+// PunktfunkClient — the macOS client app (also runs unbundled via swift run).
+// Hosts grid → trust-on-first-use → StreamView (AVSampleBufferDisplayLayer HEVC) + input.
 
 import AppKit
 import SwiftUI
@@ -12,6 +12,9 @@ struct PunktfunkClientApp: App {
         WindowGroup("punktfunk") {
             ContentView()
         }
+        Settings {
+            SettingsView()
+        }
     }
 }