fix(host): a host that is stopped hands the box's session back first

Until now the host had no signal handling at all: SIGTERM killed it
outright. That is fine for a host that owns nothing — but a managed
gamescope takeover owns the box's session, and on a mask-fragile display
manager (Nobara's plasmalogin) it has STOPPED that display manager for the
length of the stream. Killed there, the host leaves a box with no graphical
session and nothing left to restart it: the crash-restore state lives in
$XDG_RUNTIME_DIR, which logind removes along with the user manager, so not
even the next host start can heal it. `systemctl --user restart
punktfunk-host` mid-stream — or a package update doing it for you — was
enough to strand a box until someone reached a VT.

So SIGTERM and SIGINT now restore first and exit after. The restore runs on
a blocking thread (it shells out) under a 20s grace, well inside systemd's
TimeoutStopSec, and a host that took nothing over exits immediately.

`restore_takeover_now` is the synchronous sibling of the debounced
disconnect restore, and deliberately ignores the keep-alive policy the
latter honors: `keep_alive=forever` pins a session for the NEXT client,
which means nothing once the host that would serve them is exiting. Both
paths now share one `takeover_live()` predicate instead of repeating the
four-way "is anything ours" test.

Checked on Linux: clippy -D warnings on punktfunk-host + pf-vdisplay, tests,
rustfmt.

crates/pf-vdisplay/src/vdisplay/routing.rs

@@ -268,6 +268,18 @@ pub fn restore_takeover_on_startup() {
 #[cfg(not(target_os = "linux"))]
 pub fn restore_takeover_on_startup() {}
 
+/// Give the box its own session back **now**, synchronously, because the host is exiting. Blocks
+/// (it shells out to `systemctl`), so call it off the async runtime. Call from the host's shutdown
+/// path — a takeover that outlives the host leaves the box with no display manager and nobody left
+/// to restart it. No-op when nothing was taken over.
+#[cfg(target_os = "linux")]
+pub fn restore_takeover_now() {
+    gamescope::restore_takeover_now();
+}
+
+#[cfg(not(target_os = "linux"))]
+pub fn restore_takeover_now() {}
+
 #[cfg(all(test, target_os = "linux"))]
 mod tests {
     use super::*;