feat(packaging): bundle the web console into the RPM / Arch / bootc host packages

The punktfunk-web management console (pairing + status) shipped only via apt. Extend it
to the other HOST packaging methods, mirroring the Debian punktfunk-web .deb (flatpak is
the client, correctly excluded):

- rpm/punktfunk.spec: new noarch `punktfunk-web` subpackage (the .output bundle + a
  /usr/bin/punktfunk-web-server node launcher + both systemd --user units + web-init.sh +
  web.env.example), gated behind `%bcond_with web`. OFF by default because building the
  Nitro/Node SSR bundle needs `bun`, which a plain rpmbuild / COPR mock chroot lacks. Host
  package weak-Recommends punktfunk-web.
- ci/fedora-rpm.Dockerfile: install bun (+ unzip) so the CI builder can build the console.
- rpm.yml: build `PF_WITH_WEB=1` (Prep bootstraps bun to stay green pre-image-rebuild); the
  publish loop already globs the new noarch rpm into the registry. build-rpm.sh: `--with web`
  when PF_WITH_WEB=1.
- bootc/Containerfile: install from the Gitea RPM registry (which carries punktfunk-web)
  instead of COPR — `dnf5 install punktfunk punktfunk-web`.
- arch/PKGBUILD: opt-in `punktfunk-web` split member (PF_WITH_WEB=1 appends it + bun) so a
  default makepkg still builds host+client with no JS tooling — matching the spec's bcond.
- docs: packaging/README, rpm/README, copr/README (the no-bun caveat), bazzite/README
  (Path B rewritten COPR→Gitea registry), arch/README — enable + journal-password steps.

Reviewed across methods by an adversarial multi-agent pass (rpm/ci/arch/bootc/consistency
lenses, each blocking finding 3x-verified); fixed the two it confirmed real — the Arch
bun-mandatory regression (now opt-in) and the stale COPR wording in bazzite Path B.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packaging/arch/README.md

@@ -1,12 +1,17 @@
 # punktfunk on Arch Linux / SteamOS
 
 Packaging for punktfunk on Arch and Arch-derived immutable distros (SteamOS 3, etc.). The
-`PKGBUILD` is a **split package** producing both **`punktfunk-host`** (the gaming-rig host) and
+`PKGBUILD` is a **split package** producing **`punktfunk-host`** (the gaming-rig host) and
 **`punktfunk-client`** (the GTK4 couch/Deck client) — mirrors the rpm subpackages
-(`packaging/rpm/punktfunk.spec`) and the two deb build scripts. On a **Steam Deck you want
+(`packaging/rpm/punktfunk.spec`) and the deb build scripts. On a **Steam Deck you want
 `punktfunk-client`** (it's what the [Decky plugin](../../clients/decky/) launches); on a gaming
 rig, `punktfunk-host`.
 
+A third member, **`punktfunk-web`** (the browser management console — pairing + status), is
+**opt-in**: build it by setting `PF_WITH_WEB=1`, which requires **`bun`** at build time (`bun-bin`
+from the AUR if it isn't in your repos; the console then runs on plain `nodejs`). A default
+`makepkg` builds only host+client with no JS tooling — mirroring the RPM spec's `%bcond_with web`.
+
 > ⚠️ **Host encode is NVENC-only today.** `crates/punktfunk-host/src/encode/linux.rs` implements
 > `hevc_nvenc`/`av1_nvenc`/`h264_nvenc` + a CUDA zero-copy path — there is **no VAAPI encoder**. So
 > `punktfunk-host` works on **Arch + NVIDIA** (incl. `bazzite-deck-nvidia`); an **AMD Deck-as-host**
@@ -22,6 +27,8 @@ cd packaging/arch
 PF_SRCDIR="$(git rev-parse --show-toplevel)" makepkg -f --holdver
 # …or build the tagged release the AUR way:
 makepkg -si
+# …add the web console too (needs bun / bun-bin):
+PF_WITH_WEB=1 PF_SRCDIR="$(git rev-parse --show-toplevel)" makepkg -f --holdver
 ```
 Then the standard first-run (printed by the install scriptlet):
 ```sh
@@ -29,6 +36,9 @@ sudo usermod -aG input "$USER"          # virtual gamepads; re-login after
 mkdir -p ~/.config/punktfunk
 cp /usr/share/punktfunk/host.env.bazzite ~/.config/punktfunk/host.env   # gamescope backend
 systemctl --user enable --now punktfunk-host
+# Web console (if you installed the punktfunk-web package): enable it + read the login password.
+systemctl --user enable --now punktfunk-web
+journalctl --user -u punktfunk-web-init | sed -n 's/.*password generated: //p'   # open http://<host-ip>:3000
 ```
 NVENC/EGL come from the NVIDIA driver: `sudo pacman -S --needed nvidia-utils`. Arch's stock
 `ffmpeg` already has NVENC built in — no RPM-Fusion-style swap needed (unlike Fedora).