refactor(web): switch to Bun + Nitro v2 (bun preset) — proper TanStack Start deploy

The earlier "render the shell with a custom script" was a hack. The real issues were a
version matrix and a missing server target:

- TanStack Start's start-plugin-core peer-requires Vite >= 7; on Vite 6 the build's
  prerender/post-build buildApp plugin hook silently doesn't run (Vite 6 lets a
  config-level builder.buildApp suppress plugin buildApp hooks; Vite 7 runs both). Pinned
  Vite ^7 + @vitejs/plugin-react ^5 (v5 ↔ Vite 7; v6 needs Vite 8 / vite/internal).
- Added @tanstack/nitro-v2-vite-plugin with the `bun` preset — the server/deploy target.
  `bun run build` → .output/ (bun-runnable server + .output/public). `bun run start` =
  `bun run .output/server/index.mjs`.
- Full SSR instead of SPA mode: SPA-shell prerender points its preview server at the old
  dist/server/server.js path that Nitro relocates, breaking the build. The Nitro server
  renders the shell per request; React Query fetches client-side after hydration.
- Nitro routeRules proxy /api/** → PUNKTFUNK_MGMT_URL (default 127.0.0.1:47990), so the
  browser stays same-origin (bearer token rides along, no CORS).

Toolchain is now Bun (package manager + runtime): bun.lock replaces pnpm-lock.yaml;
scripts/prepare/start use bun. Validated live: bun build → .output, bun server SSR-renders
the console on :3000 and proxies the API (health/host return through it). tsc clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

web/README.md

@@ -4,18 +4,19 @@ The browser UI for the punktfunk host's **management REST API** (`crates/punktfu
 OpenAPI at `docs/api/openapi.json`). It shows live status, host capabilities, paired
 clients, the pairing-PIN flow, and session controls.
 
-Stack: **TanStack Start** (Vite, SPA mode) · **React Query** via **orval** codegen from the
-OpenAPI spec · **shadcn/ui** (Tailwind v4) · **Paraglide** i18n (en/de).
+Stack: **TanStack Start** (full SSR) on **Bun** via **Nitro v2** (`bun` preset) · **React
+Query** through **orval** codegen from the OpenAPI spec · **shadcn/ui** (Tailwind v4) ·
+**Paraglide** i18n (en/de). Package manager + runtime: **Bun**.
 
 ## Develop
 
 ```sh
-# from web/
-pnpm install              # runs `prepare` → codegen (orval + paraglide)
-pnpm dev                  # http://localhost:3000
+# from web/  — Bun is the toolchain (https://bun.sh)
+bun install               # runs `prepare` → codegen (orval + paraglide)
+bun run dev               # http://localhost:3000
 
 # The dev server proxies /api → http://127.0.0.1:47990 (the host's management API).
-# Point it elsewhere with PUNKTFUNK_MGMT_URL=http://<host>:47990 pnpm dev
+# Point it elsewhere: PUNKTFUNK_MGMT_URL=http://<host>:47990 bun run dev
 ```
 
 Start a host with the management API up:
@@ -30,15 +31,36 @@ WAYLAND_DISPLAY=wayland-kde XDG_CURRENT_DESKTOP=KDE \
 If the host runs with `--mgmt-token`, set it under **Settings → API token** (stored in
 `localStorage`, sent as `Authorization: Bearer …` by the orval fetcher).
 
+## Build & run (Nitro + Bun)
+
+```sh
+bun run build             # → .output/  (Nitro server, `bun` preset, + .output/public assets)
+PORT=3000 HOST=0.0.0.0 bun run start    # = bun run .output/server/index.mjs
+bun run lint              # tsc --noEmit
+```
+
+The built **Nitro Bun server** SSR-renders the app and proxies `/api/**` to the management
+host (a Nitro `routeRules` proxy → `PUNKTFUNK_MGMT_URL`, default `127.0.0.1:47990`), so the
+browser stays same-origin (bearer token rides along, no CORS). Run it on the same box as
+the host; it serves the console on `:3000` (or `$PORT`).
+
+> Toolchain notes (load-bearing): TanStack Start's `start-plugin-core` peer-requires
+> **Vite ≥ 7** — on Vite 6 the build's prerender/post-build hook silently doesn't run.
+> `@vitejs/plugin-react` must match Vite (v5 ↔ Vite 7, v6 ↔ Vite 8); it's **required even
+> for dev** (TanStack Start's dev mode needs the React Refresh runtime, else a blank
+> screen). Nitro is the server target — without it `vite build` only emits client+SSR
+> bundles, no deployable server. The Nitro `bun` preset makes `.output/server/index.mjs`
+> Bun-runnable.
+
 ## Codegen
 
-Generated code is **not committed** (gitignored) — it's reproduced from sources:
+Generated code is **not committed** (gitignored) — reproduced from sources:
 
-- `pnpm codegen` — regenerate the API client (orval) + i18n runtime (paraglide). Runs
-  automatically on `pnpm install` (`prepare`) and before `dev`/`build` (`pre*` for orval;
-  the Vite plugin compiles paraglide on dev/build).
+- `bun run codegen` — regenerate the API client (orval) + i18n runtime (paraglide). Runs on
+  `bun install` (`prepare`) and before `dev`/`build` (`pre*` for orval; the Vite plugin
+  compiles paraglide on dev/build).
 - After a management-API change, regenerate the spec on the Rust side first:
-  `cargo run -p punktfunk-host -- openapi > docs/api/openapi.json`, then `pnpm api:gen`.
+  `cargo run -p punktfunk-host -- openapi > docs/api/openapi.json`, then `bun run api:gen`.
 
 ## Layout
 
@@ -56,13 +78,3 @@ src/
   paraglide/         GENERATED i18n runtime (paraglide)
 messages/{en,de}.json   translation sources
 ```
-
-## Build
-
-```sh
-pnpm build            # client + SSR bundles under dist/
-pnpm lint             # tsc --noEmit
-```
-
-A future step serves the built assets from the host itself (same origin as the API);
-today it's a standalone dev/preview app against the loopback management port.