fix(security): land the 2026-07 audit fixes — SSRF guards, roster lane, SYSTEM path hygiene

The low/medium findings from the July host+Windows security review, as
implemented in the audit session's working tree:

- Webhooks and library-art fetches refuse loopback/link-local/metadata
  targets and no longer follow redirects (SSRF pivots from the privileged
  host process).
- The paired-client rosters (/clients, /native/clients) move off the
  streaming-client auth lane — one paired device could enumerate every other
  device's name + fingerprint; only the bearer/loopback console keeps them.
- Device-name sanitizing extends to bidi/format control characters
  (spoofable rendering) via the shared native_pairing::is_spoofy_char;
  stream-marker quoting uses the same set.
- The SYSTEM service resolves powershell by its full System32 path —
  CreateProcess checks the launching EXE's own directory first, so a planted
  powershell.exe beside the host binary would have run as SYSTEM.
- The pf-vdisplay driver's opt-in file log moves from world-writable
  C:\Users\Public to WUDFHost's own temp dir.
- GameStream pairing sessions are single-use (removed whatever the outcome).
- Uninstall also removes the pf_mouse driver-store entry (rider from the
  virtual-HID-mouse work).
- openapi.json regenerated (hardened-config-dir doc wording).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/punktfunk-host/src/mgmt/clients.rs

@@ -47,7 +47,12 @@ pub(crate) struct SubmitPin {
 pub(crate) async fn list_paired_clients(
     State(st): State<Arc<MgmtState>>,
 ) -> Json<Vec<PairedClient>> {
-    let ders = st.app.paired.lock().unwrap().clone();
+    let ders = st
+        .app
+        .paired
+        .lock()
+        .unwrap_or_else(|e| e.into_inner())
+        .clone();
     Json(ders.iter().map(|der| client_info(der)).collect())
 }
 
@@ -101,7 +106,7 @@ pub(crate) async fn unpair_client(
             "fingerprint must be the 64-char hex SHA-256 of the client certificate DER",
         );
     }
-    let mut paired = st.app.paired.lock().unwrap();
+    let mut paired = st.app.paired.lock().unwrap_or_else(|e| e.into_inner());
     let before = paired.len();
     paired.retain(|der| !hex::encode(Sha256::digest(der)).eq_ignore_ascii_case(&fingerprint));
     if paired.len() < before {