fix(security): land the 2026-07 audit fixes — SSRF guards, roster lane, SYSTEM path hygiene

The low/medium findings from the July host+Windows security review, as
implemented in the audit session's working tree:

- Webhooks and library-art fetches refuse loopback/link-local/metadata
  targets and no longer follow redirects (SSRF pivots from the privileged
  host process).
- The paired-client rosters (/clients, /native/clients) move off the
  streaming-client auth lane — one paired device could enumerate every other
  device's name + fingerprint; only the bearer/loopback console keeps them.
- Device-name sanitizing extends to bidi/format control characters
  (spoofable rendering) via the shared native_pairing::is_spoofy_char;
  stream-marker quoting uses the same set.
- The SYSTEM service resolves powershell by its full System32 path —
  CreateProcess checks the launching EXE's own directory first, so a planted
  powershell.exe beside the host binary would have run as SYSTEM.
- The pf-vdisplay driver's opt-in file log moves from world-writable
  C:\Users\Public to WUDFHost's own temp dir.
- GameStream pairing sessions are single-use (removed whatever the outcome).
- Uninstall also removes the pf_mouse driver-store entry (rider from the
  virtual-HID-mouse work).
- openapi.json regenerated (hardened-config-dir doc wording).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/punktfunk-host/src/library/art.rs

@@ -88,6 +88,10 @@ fn warm_art_once() {
 fn fetch_json(url: &str) -> Option<serde_json::Value> {
     let agent = ureq::AgentBuilder::new()
         .timeout(std::time::Duration::from_secs(10))
+        // Don't follow redirects — a redirect target (`3xx` → `http://169.254.169.254/…` or an
+        // internal host) would be an SSRF pivot from the privileged host. Matches the webhook path
+        // (security-review 2026-07-17). A rare legitimately-redirecting CDN just yields no art.
+        .redirects(0)
         .build();
     let body = agent.get(url).call().ok()?.into_string().ok()?;
     serde_json::from_str(&body).ok()
@@ -123,6 +127,10 @@ pub(crate) fn fetch_image(url: &str) -> Option<(Vec<u8>, String)> {
     }
     let agent = ureq::AgentBuilder::new()
         .timeout(std::time::Duration::from_secs(10))
+        // Don't follow redirects (SSRF pivot): this is called on launcher-cache- and custom-entry-
+        // supplied URLs, so a `3xx` to an internal/metadata endpoint must not be chased by the
+        // privileged host. Matches the webhook path (security-review 2026-07-17).
+        .redirects(0)
         .build();
     let resp = agent.get(url).call().ok()?;
     let ctype = resp