feat(trust): host-gated trust-on-first-use — PIN pairing mandatory by default

TOFU let anyone who could reach the host click "Trust" and stream, which defeats the point
on a LAN. Make SPAKE2 PIN pairing the default and only way to trust a NEW host; TOFU survives
as an explicit HOST opt-in (for fully trusted networks), advertised over mDNS so clients render
their trust UI from the host's policy rather than offering trust on faith.

Contract:
- Host advertises pair=required (default) or pair=optional. pair=required rejects unpaired
  clients at the handshake; pair=optional accepts them (TOFU).
- Clients: a pinned host whose fingerprint matches connects silently; a pinned host whose
  fingerprint CHANGED forces re-pairing via PIN (no re-trust shortcut); a NEW host is offered
  TOFU only if it advertised pair=optional, otherwise PIN pairing is mandatory; a manually-typed
  or unknown-policy host is always PIN.

Host (crates/punktfunk-host/src/main.rs):
- m3-host now REQUIRES pairing by default (was open by default). New --allow-tofu opts into
  accepting unpaired clients + advertising pair=optional; pairing is always armed (PIN logged at
  startup). serve --native was already secure-by-default (serve --open). The mDNS advert and the
  accept loop already mapped require_pairing -> pair=required + reject; only the m3-host CLI
  default + help text changed.

Clients honor the advertised policy:
- Android (MainActivity.kt): TOFU only for a discovered pair=optional host; manual/unknown -> PIN;
  fp-change -> re-pair only (dropped the "Forget & re-TOFU" shortcut).
- Apple (HostDiscovery/SessionModel/ContentView/HostCards/HostStore): new allowsTofu
  (pair==optional, distinct from unknown); connect() gates .awaitingTrust on it; unpinned
  non-optional hosts route to the PIN sheet; "Forget Identity" re-pairs rather than re-TOFUs.
- Linux (app.rs/ui_hosts.rs/session.rs): ConnectRequest.pair_required -> pair_optional;
  initiate_connect routes pinned/fp-changed/optional/else; manual + --connect unknown -> PIN; a
  pinned connect rejected on trust grounds re-pairs.

Docs (CLAUDE.md, README.md, docs-site/content/docs/pairing.md): describe the gated model — PIN is
the default, TOFU an explicit opt-in with an impostor warning.

Verified: host cargo check/clippy/fmt clean; Android built + live (emulator -> home-worker-2):
a manual connect now opens the PIN dialog (no Trust button) and the PIN ceremony streams; Apple
swift build clean; Linux clippy -D warnings + fmt clean on the Linux box.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/punktfunk-host/src/main.rs

@@ -184,8 +184,13 @@ fn real_main() -> Result<()> {
                 max_concurrent: get("--max-concurrent")
                     .and_then(|s| s.parse().ok())
                     .unwrap_or(m3::DEFAULT_MAX_CONCURRENT),
-                require_pairing: args.iter().any(|a| a == "--require-pairing"),
-                allow_pairing: args.iter().any(|a| a == "--allow-pairing"),
+                // Secure by default: REQUIRE PIN pairing (reject unpaired clients) unless
+                // --allow-tofu opts into trust-on-first-use — the host then accepts unpaired
+                // clients and advertises pair=optional. Pairing is always armed so a PIN is
+                // available (logged at startup); `--require-pairing`/`--allow-pairing` are now
+                // the default and accepted as no-ops for back-compat.
+                require_pairing: !args.iter().any(|a| a == "--allow-tofu"),
+                allow_pairing: true,
                 pairing_pin: None,
                 paired_store: None,
             })
@@ -446,9 +451,10 @@ M3-HOST OPTIONS:
     --max-sessions <N>           exit after N sessions; 0 = serve forever (default: 0)
     --max-concurrent <N>         stream at most N sessions at once (NVENC bound); overflow waits
                                  in the accept queue; 0 = unlimited (default: 4)
-    --allow-pairing              accept PIN pairing ceremonies (arm pairing mode)
-    --require-pairing            only serve PIN-paired clients (implies --allow-pairing;
-                                 the host logs a 4-digit PIN when a client starts pairing)
+    --allow-tofu                 also accept UNPAIRED clients (trust-on-first-use) and advertise
+                                 pair=optional. Default: pairing REQUIRED — the host rejects
+                                 unpaired clients and logs a 4-digit pairing PIN at startup;
+                                 TOFU without pairing is insecure on a LAN
 
 M0 OPTIONS:
     --source <synthetic|portal|kwin-virtual>