feat(windows): add deploy-all.ps1 wrapper; fix web console health check

deploy-all.ps1 chains deploy-host.ps1 + build-web.ps1 so a full redeploy is
one command; stops before the web step if the host build/start fails.
build-web.ps1's post-restart check was probing http:// while web-run.cmd
serves HTTPS-only, so it always reported a false failure - probe https via
curl.exe (no -SkipCertificateCheck on the Windows PowerShell 5.1 this runs
under) with a short retry loop for the task's cold start instead.

scripts/windows/README.md

@@ -55,10 +55,19 @@ powershell -ExecutionPolicy Bypass -File scripts\windows\build-web.ps1
 this to iterate on the console against an installed host - `punktfunk-host.exe web setup` (or a
 fresh install) is what creates the task in the first place.
 
+## Rebuild + redeploy everything
+
+```powershell
+powershell -ExecutionPolicy Bypass -File scripts\windows\deploy-all.ps1
+```
+
+Thin wrapper: runs `deploy-host.ps1` then `build-web.ps1` in sequence. If the host build/start
+fails, `deploy-host.ps1` rolls itself back and throws, which stops this script before the web
+console step runs.
+
 ## Typical flow after pulling new code
 
 ```powershell
 git pull
-powershell -ExecutionPolicy Bypass -File scripts\windows\deploy-host.ps1
-powershell -ExecutionPolicy Bypass -File scripts\windows\build-web.ps1
+powershell -ExecutionPolicy Bypass -File scripts\windows\deploy-all.ps1
 ```

scripts/windows/build-web.ps1

@@ -28,8 +28,18 @@ Get-CimInstance Win32_Process -Filter "Name='bun.exe' OR Name='node.exe'" -Error
   ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }
 Start-Sleep 2
 & schtasks /run /tn $task | Out-Null
-Start-Sleep 5
-try {
-  $r = Invoke-WebRequest 'http://127.0.0.1:47992/login' -UseBasicParsing -TimeoutSec 10
-  Write-Host "DONE - web /login -> HTTP $($r.StatusCode)"
-} catch { Write-Warning "web restarted but /login check failed: $($_.Exception.Message)" }
+
+# web-run.cmd serves HTTPS-only (PUNKTFUNK_UI_SECURE=1, the host's own cert) - probe with curl.exe
+# (-k for the self-signed cert; Invoke-WebRequest under Windows PowerShell 5.1, which this script
+# runs under, has no -SkipCertificateCheck), retrying while the task/bun cold-starts.
+$code = $null
+for ($i = 0; $i -lt 15; $i++) {
+  Start-Sleep 2
+  $code = & curl.exe -sk -o NUL -w '%{http_code}' --max-time 5 'https://127.0.0.1:47992/login' 2>$null
+  if ($code -eq '200') { break }
+}
+if ($code -eq '200') {
+  Write-Host "DONE - web /login -> HTTP $code"
+} else {
+  Write-Warning "web restarted but /login check did not return 200 (last: $code)"
+}

scripts/windows/deploy-all.ps1

@@ -0,0 +1,26 @@
+<#
+  Rebuild + redeploy everything: the Windows host service AND the web management console.
+  Thin wrapper around deploy-host.ps1 + build-web.ps1 - see scripts\windows\README.md for what
+  each one does on its own (rollback behavior, build env, etc).
+
+    powershell -ExecutionPolicy Bypass -File scripts\windows\deploy-all.ps1
+
+  Run from an elevated PowerShell. deploy-host.ps1 throws (and rolls itself back) on a failed
+  build/start, which stops this script before the web console step runs.
+#>
+$ErrorActionPreference = 'Stop'
+$here = $PSScriptRoot
+
+Write-Host "=========================================="
+Write-Host " 1/2  host service"
+Write-Host "=========================================="
+& (Join-Path $here 'deploy-host.ps1')
+
+Write-Host ""
+Write-Host "=========================================="
+Write-Host " 2/2  web console"
+Write-Host "=========================================="
+& (Join-Path $here 'build-web.ps1')
+
+Write-Host ""
+Write-Host "DONE - host + web console redeployed."