feat: client-selectable compositor (protocol → host → client → C ABI → mgmt → web)

A client can now request which compositor backend the host drives its virtual
output on (gamescope/KWin/Mutter/wlroots). The host honors the request if that
backend is available, else falls back to auto-detect and reports the resolved
choice back — wire-compatible both directions (no ABI bump).

Protocol (punktfunk-core):
- New CompositorPref (config.rs): Auto|Kwin|Wlroots|Mutter|Gamescope with
  u8/name mappings. Appended as one optional byte to Hello (client preference)
  and Welcome (host's resolved choice). Both decoders already tolerate trailing
  bytes, so old↔new interop is preserved — ABI_VERSION stays 2. Round-trip +
  back-compat (truncated-message) tests.
- C ABI: punktfunk_connect_ex(compositor) + PUNKTFUNK_COMPOSITOR_* constants;
  punktfunk_connect delegates with AUTO, so the existing symbol is unchanged.
  NativeClient::connect / worker_main thread the preference through.

Host:
- vdisplay::available() enumerates usable backends via cheap, side-effect-free
  probes (KWin zkde global, gamescope binary+version, GNOME/Sway env), plus
  Compositor id/label/as_pref/from_pref/all helpers.
- m3 handshake resolves the preference to a concrete backend during the
  handshake (pick_compositor pure + resolved logging), reports it in Welcome,
  and threads it into virtual_stream (replacing the unconditional detect()).
- mgmt GET /v1/compositors lists every backend with availability + the
  auto-detected default (OpenAPI regenerated).

Client:
- punktfunk-client-rs --compositor NAME; logs the host's resolved choice from
  the Welcome ("session offer … compositor=…").

Web console:
- Host page gains a Compositors card (availability + default badges) via the
  codegen'd useListCompositors hook; en/de strings added.

Also fixes a pre-existing, env-dependent test-isolation bug:
mgmt::tests::paired_clients_list_and_unpair seeded the real
~/.config/punktfunk/paired.json (AppState::new loads it), so a real
GameStream-paired client leaked into body[0] on a dev box — now cleared first.

Live-validated against headless KWin: --compositor kwin honored, --compositor
mutter falls back to kwin (available=[kwin, gamescope]), resolved choice
round-trips to the client. Tests: +6 (wire/back-compat, resolution precedence,
endpoint); workspace green, clippy/fmt clean, C ABI harness PASS at abi_version=2,
web typecheck + build clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/punktfunk-core/src/config.rs

@@ -58,6 +58,78 @@ pub struct Mode {
     pub refresh_hz: u32,
 }
 
+/// Which compositor backend a client would like the host to drive for its virtual output.
+///
+/// Sent in [`Hello`](crate::quic::Hello) as a *preference* and echoed back — resolved to the
+/// backend actually chosen — in [`Welcome`](crate::quic::Welcome). `Auto` (the default) lets the
+/// host decide (auto-detect from the running desktop). A concrete preference is honored only if
+/// that backend is available on the host right now; otherwise the host falls back to auto-detect
+/// and reports the real choice in `Welcome`. The wire form is a single byte (`0 = Auto`,
+/// `1..=4` concrete), appended to `Hello`/`Welcome` — older peers simply omit/ignore it.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Default)]
+pub enum CompositorPref {
+    /// Let the host pick (auto-detect from the running desktop / its configured default).
+    #[default]
+    Auto,
+    /// KWin / KDE Plasma.
+    Kwin,
+    /// wlroots (Sway / Hyprland).
+    Wlroots,
+    /// Mutter / GNOME.
+    Mutter,
+    /// gamescope (spawned nested — available wherever the binary is installed).
+    Gamescope,
+}
+
+impl CompositorPref {
+    /// Wire byte. `0 = Auto`, `1 = Kwin`, `2 = Wlroots`, `3 = Mutter`, `4 = Gamescope`.
+    pub fn to_u8(self) -> u8 {
+        match self {
+            CompositorPref::Auto => 0,
+            CompositorPref::Kwin => 1,
+            CompositorPref::Wlroots => 2,
+            CompositorPref::Mutter => 3,
+            CompositorPref::Gamescope => 4,
+        }
+    }
+
+    /// Inverse of [`to_u8`](Self::to_u8). An unknown byte decodes to `Auto` — forward-compatible:
+    /// a future concrete value a peer doesn't recognize degrades to "let the host decide".
+    pub fn from_u8(v: u8) -> Self {
+        match v {
+            1 => CompositorPref::Kwin,
+            2 => CompositorPref::Wlroots,
+            3 => CompositorPref::Mutter,
+            4 => CompositorPref::Gamescope,
+            _ => CompositorPref::Auto,
+        }
+    }
+
+    /// Parse a CLI/config name (case-insensitive, with the usual desktop aliases). `None` for an
+    /// unrecognized name, so callers can error rather than silently defaulting to `Auto`.
+    pub fn from_name(s: &str) -> Option<Self> {
+        Some(match s.trim().to_ascii_lowercase().as_str() {
+            "auto" | "detect" | "default" => CompositorPref::Auto,
+            "kwin" | "kde" | "plasma" => CompositorPref::Kwin,
+            "wlroots" | "sway" | "hyprland" | "wlr" => CompositorPref::Wlroots,
+            "mutter" | "gnome" => CompositorPref::Mutter,
+            "gamescope" => CompositorPref::Gamescope,
+            _ => return None,
+        })
+    }
+
+    /// Canonical lowercase identifier (`"auto"`, `"kwin"`, `"wlroots"`, `"mutter"`, `"gamescope"`).
+    pub fn as_str(self) -> &'static str {
+        match self {
+            CompositorPref::Auto => "auto",
+            CompositorPref::Kwin => "kwin",
+            CompositorPref::Wlroots => "wlroots",
+            CompositorPref::Mutter => "mutter",
+            CompositorPref::Gamescope => "gamescope",
+        }
+    }
+}
+
 /// Per-block FEC parameters. Recovery count is derived from `fec_percent` exactly as
 /// GameStream does: `m = ceil(k * fec_percent / 100)`.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]