fix(web): console sweep — pairing, displays, stats, logs, auth, i18n

Pairing:
- Refresh the paired-devices list after a native PIN pairing (the happy path never
  invalidated it, so a newly paired device stayed hidden until remount).
- Moonlight PIN: a 204 means "PIN delivered to the waiting handshake", NOT paired, so
  it now reads "PIN sent" instead of a false "Paired successfully".
- Hide the Moonlight pairing card on native-only hosts (HostInfo.gamestream) — it could
  never receive a PIN there.
- Per-row pending on unpair/approve/deny; PIN input maxLength 16 (was 8).

Displays / Library:
- "Arrange displays" save refreshes the settings card (it rewrites the policy), without
  clobbering unsaved Custom edits (re-seed only when the draft still matches the server).
- Live-display list wrapped in QueryState so errors don't read as "no displays".
- "Forever" keep-alive option in the custom editor; edit-game form round-trips the logo
  artwork (was dropped on save); per-card delete pending.

Stats:
- Distinct colour for the native "queue" latency stage (it collided with "capture").
- "Not measured on this path" note on the GameStream health chart; configured-bitrate
  target line on throughput; host-authoritative elapsed timer; LiveCard surfaces
  non-404 errors.

Shell / auth / i18n:
- SSR-stable locale: first client render matches the base-locale SSR (no hydration
  mismatch), then adopts the persisted/browser locale post-hydration.
- BFF proxy maps an upstream (mgmt-token) 401 to 502 so a logged-in user isn't bounced
  into a post-login redirect loop.
- Logout checks the POST result before navigating; logs dedup by seq (StrictMode);
  login "next" keeps query/hash; Dashboard shows the active-session count.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

web/messages/de.json

@@ -17,6 +17,7 @@
 	"status_streaming": "Aktiv",
 	"status_idle": "Inaktiv",
 	"status_session": "Sitzung",
+	"status_sessions_active": "{count} aktiv",
 	"status_no_session": "Keine aktive Sitzung",
 	"status_paired_count": "Gekoppelte Geräte",
 	"status_pin_pending": "Kopplungs-PIN ausstehend",
@@ -63,6 +64,7 @@
 	"display_keep_alive": "Nach Trennung aktiv halten",
 	"display_keep_alive_off": "Aus",
 	"display_keep_alive_keep": "Behalten für",
+	"display_keep_alive_forever": "Dauerhaft",
 	"display_keep_alive_seconds": "Sekunden",
 	"display_topology": "Topologie",
 	"display_topology_auto": "Automatisch",
@@ -137,8 +139,8 @@
 	"pairing_waiting": "Ein Gerät wartet auf Kopplung. Gib die angezeigte PIN ein:",
 	"pairing_pin_label": "PIN",
 	"pairing_submit": "PIN bestätigen",
-	"pairing_success": "Erfolgreich gekoppelt.",
-	"pairing_failed": "Kopplung fehlgeschlagen — PIN prüfen und erneut versuchen.",
+	"pairing_pin_sent": "PIN gesendet. Wenn sie stimmt, schließt der Client die Kopplung ab und erscheint unten unter „Gekoppelte Geräte“.",
+	"pairing_failed": "PIN konnte nicht übermittelt werden — prüfe, ob sie stimmt und der Client noch auf die Kopplung wartet.",
 	"pairing_native_title": "Gerät koppeln",
 	"pairing_native_desc": "Zeige hier eine Einmal-PIN an und gib sie in deiner Punktfunk-App ein, um dieses Gerät zu koppeln.",
 	"pairing_native_disabled": "Der native Host läuft nicht. Starte ihn mit `serve --native`, um Punktfunk-Geräte zu koppeln.",
@@ -172,6 +174,7 @@
 	"library_field_portrait": "Portrait-Bild-URL",
 	"library_field_hero": "Hero-Bild-URL",
 	"library_field_header": "Header-Bild-URL",
+	"library_field_logo": "Logo-Bild-URL",
 	"library_field_command": "Startbefehl",
 	"library_field_command_help": "Optional. Der Befehl, mit dem der Host diesen Titel startet.",
 	"library_save": "Speichern",
@@ -200,6 +203,7 @@
 	"login_error": "Falsches Passwort.",
 	"login_signing_in": "Anmeldung läuft…",
 	"action_logout": "Abmelden",
+	"settings_logout_failed": "Abmelden fehlgeschlagen — du bist weiterhin angemeldet. Bitte versuche es erneut.",
 	"nav_stats": "Leistung",
 	"nav_logs": "Logs",
 	"logs_title": "Logs",
@@ -233,6 +237,8 @@
 	"stats_fps_new": "Neue fps",
 	"stats_fps_repeat": "Wiederholte fps",
 	"stats_mbps": "Mb/s",
+	"stats_bitrate_target": "Ziel-Mb/s",
+	"stats_health_gamestream_note": "Paketverlust, Sende-Drops und FEC-Wiederherstellung sind empfängerseitige Werte, die der GameStream-Pfad nicht erfasst — hier werden nur Frame-Drops angezeigt.",
 	"stats_p99": "p99",
 	"stats_p50": "p50",
 	"stats_frames_dropped": "Verworfene Frames",

web/messages/en.json

@@ -17,6 +17,7 @@
 	"status_streaming": "Streaming",
 	"status_idle": "Idle",
 	"status_session": "Session",
+	"status_sessions_active": "{count} active",
 	"status_no_session": "No active session",
 	"status_paired_count": "Paired clients",
 	"status_pin_pending": "Pairing PIN pending",
@@ -63,6 +64,7 @@
 	"display_keep_alive": "Keep alive after disconnect",
 	"display_keep_alive_off": "Off",
 	"display_keep_alive_keep": "Keep for",
+	"display_keep_alive_forever": "Forever",
 	"display_keep_alive_seconds": "seconds",
 	"display_topology": "Topology",
 	"display_topology_auto": "Automatic",
@@ -137,8 +139,8 @@
 	"pairing_waiting": "A client is waiting to pair. Enter the PIN it shows:",
 	"pairing_pin_label": "PIN",
 	"pairing_submit": "Submit PIN",
-	"pairing_success": "Paired successfully.",
-	"pairing_failed": "Pairing failed — check the PIN and try again.",
+	"pairing_pin_sent": "PIN sent. If it's correct, the client finishes pairing and appears under Paired devices below.",
+	"pairing_failed": "Couldn't submit the PIN — check it's correct and that the client is still waiting to pair.",
 	"pairing_native_title": "Pair a device",
 	"pairing_native_desc": "Show a one-time PIN here, then enter it in your Punktfunk app to pair this device.",
 	"pairing_native_disabled": "The native host isn't running. Start it with `serve --native` to pair Punktfunk devices.",
@@ -172,6 +174,7 @@
 	"library_field_portrait": "Portrait art URL",
 	"library_field_hero": "Hero art URL",
 	"library_field_header": "Header art URL",
+	"library_field_logo": "Logo art URL",
 	"library_field_command": "Launch command",
 	"library_field_command_help": "Optional. The command the host runs to launch this title.",
 	"library_save": "Save",
@@ -200,6 +203,7 @@
 	"login_error": "Wrong password.",
 	"login_signing_in": "Signing in…",
 	"action_logout": "Sign out",
+	"settings_logout_failed": "Sign-out failed — you're still signed in. Please try again.",
 	"nav_stats": "Performance",
 	"nav_logs": "Logs",
 	"logs_title": "Logs",
@@ -233,6 +237,8 @@
 	"stats_fps_new": "New fps",
 	"stats_fps_repeat": "Repeat fps",
 	"stats_mbps": "Mb/s",
+	"stats_bitrate_target": "Target Mb/s",
+	"stats_health_gamestream_note": "Packet loss, send-drops, and FEC recovery are receiver-side metrics the GameStream path doesn't instrument — only frame drops are shown here.",
 	"stats_p99": "p99",
 	"stats_p50": "p50",
 	"stats_frames_dropped": "Frames dropped",