feat(tray): system-tray status icon for the host (Windows + Linux)

New crates/punktfunk-tray — a small per-user companion showing the host service
state at a glance (running / stopped / starting / degraded / failed + the live
session in the tooltip) with one-click actions: open web console, approve a
pending pairing request, start/stop/restart, open logs. No more digging through
logs to learn whether the service came back after a reboot or an update.

Status is service-manager-FIRST (SCM / systemd user unit — a port squatter can
never fake Running), then the new loopback-only unauthenticated
GET /api/v1/local/summary (counts/booleans only; the mgmt token and cert.pem
are SYSTEM/Admins-DACL'd on Windows, so a non-elevated tray cannot bearer-auth).

Windows: windows_subsystem binary (a console exe in the Run key would flash a
terminal at sign-in), Shell_NotifyIcon + hidden window, per-session single
instance, TaskbarCreated re-add, --quit for the uninstaller; service actions
elevate per click via ShellExecuteW "runas" onto the new
`punktfunk-host service restart` (stop → wait Stopped → start).
Linux: ksni/StatusNotifierItem over zbus, systemctl --user actions (no polkit),
/etc/xdg/autostart entry whose --autostart self-gates to actual host users.
Icons: scripts/gen-tray-icons.py (pure stdlib) renders the brand lens + status
dot into committed .ico/hicolor assets; deb/rpm/arch ship binary+autostart+icons.

Live-validated: Linux on the headless KDE session (SNI registration, state
transitions, menu-driven start, dbusmenu layout); Windows on the RTX box
(session-1 launch with no NIM_ADD failure, single instance, --quit, restart
round-trip, summary loopback-200/LAN-401).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/punktfunk-tray/Cargo.toml

@@ -0,0 +1,56 @@
+[package]
+name = "punktfunk-tray"
+description = "System-tray status icon for the punktfunk streaming host (Windows notification area / Linux StatusNotifierItem)"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+authors.workspace = true
+repository.workspace = true
+
+[[bin]]
+name = "punktfunk-tray"
+path = "src/main.rs"
+
+# Deliberately does NOT depend on punktfunk-host: the tray needs only the service name, the mgmt
+# port, and the summary JSON shape — a dependency would drag the whole host (FFmpeg, PipeWire, …)
+# into a 2 MB helper and make it un-buildable standalone. Non-Windows/non-Linux targets build a
+# stub main (same pattern as the platform-gated clients).
+[dependencies]
+anyhow = "1"
+
+[target.'cfg(any(windows, target_os = "linux"))'.dependencies]
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+# Loopback HTTPS poll of GET /api/v1/local/summary. Same sync ureq + rustls(ring) stack and
+# custom-verifier pattern as the Linux client's library fetch (clients/linux/src/library.rs) —
+# but ring-only (no default aws-lc-rs provider: it needs a C toolchain per target and the agent
+# pins the ring provider explicitly anyway).
+ureq = { version = "2", default-features = false, features = ["tls"] }
+rustls = { version = "0.23", default-features = false, features = ["ring", "logging", "std", "tls12"] }
+sha2 = "0.10"
+
+[target.'cfg(windows)'.dependencies]
+# SCM QUERY_STATUS works unprivileged — the service-state probe. Same crate the host service uses.
+windows-service = "0.7"
+windows = { version = "0.62", features = [
+    "Win32_Foundation",
+    "Win32_Graphics_Gdi",
+    "Win32_Security", # CreateMutexW's SECURITY_ATTRIBUTES parameter type
+    "Win32_System_LibraryLoader",
+    "Win32_System_Threading",
+    "Win32_UI_Shell",
+    "Win32_UI_WindowsAndMessaging",
+] }
+
+[target.'cfg(target_os = "linux")'.dependencies]
+# StatusNotifierItem (pure Rust, zbus — the same zbus the host already pulls via ashpd). The tray
+# is a plain-threads poller, so the blocking API over the small async-io executor (`blocking`
+# alone is just the wrapper — zbus still needs an executor; no tokio runtime in a tray icon).
+ksni = { version = "0.3", default-features = false, features = ["async-io", "blocking"] }
+libc = "0.2"
+
+# Build-time icon embedding (exe icon + the status-variant tray icons), host-gated like the
+# Windows client's build.rs — cross-builds from Linux CI runners skip it.
+[target.'cfg(windows)'.build-dependencies]
+winresource = "0.1"