merge: display-management (Stages 0-5 §6A + keep-alive hardening + gaming-rig)

Merges display-mgmt-stage0 — the user-configurable virtual-display policy layer above the
per-compositor backends. On-glass validated (KWin .116 + Mutter .21; Windows compile-verified .173):

- Policy surface (keep_alive · topology · conflict · identity · layout · max) →
  display-settings.json, console-editable via /api/v1/display/{settings,state,release,layout} + a
  dedicated "Virtual displays" console section. All five axes enforced, not just stored.
- Lifecycle: pure state machine + Linux keep-alive pool (registry + DisplayLease ownership split),
  incl. keep_alive=forever/Pinned (freed via /display/release); topology extend/primary/exclusive
  (group-aware); per-client identity (KWin per-slot names → KDE scaling round-trips); mode_conflict
  admission (Windows default reject, single-capturer IDD); §6A multi-monitor (display groups +
  layout engine + console arrangement table — several clients as monitors of one desktop).
- Keep-alive reconnect hardened: same-client zombie preempt (never a 2nd display), deliberate-quit
  skip-linger (QUIT_CLOSE_CODE), tunable idle timeout (PUNKTFUNK_IDLE_TIMEOUT_MS).

Conflicts (packaging/{arch,debian}/README.md firewall docs): kept main's ufw/nft port commands +
the branch's --data-port documentation. build + clippy -D warnings + cargo test --workspace
(18 suites, 0 failed) green on the merged tree.

packaging/debian/README.md

@@ -76,8 +76,16 @@ open its port with the matching one-liner — `sudo ufw allow punktfunk-web` or
 Prefer explicit rules? Open the ports directly. The **native `punktfunk/1`** plane:
 
 - **QUIC control plane: UDP 9777** (`serve --native-port N` to change).
-- **Data plane: an *ephemeral* UDP port** the client hole-punches — nothing to open inbound as long
-  as outbound UDP is allowed (the host streams back out through the client-opened path).
+- **Data plane: a separate UDP port.** By default it's *random* — the host binds `0.0.0.0:0` and
+  tells the client which port it got. Video flows host → client, but the **client sends the first
+  packet** (a hole-punch), so the host learns the client's real source and streams back — this
+  traverses NAT / inter-VLAN with no forwarded port. **You normally don't open it:** if a deny-inbound
+  firewall drops the punch, the host waits ~2.5 s and falls back to the client-reported address, and a
+  stateful firewall then admits the return (it just adds ~2.5 s to session start). To skip that delay,
+  pin it with **`serve --data-port <PORT>`** (or `PUNKTFUNK_DATA_PORT`): the host binds that fixed
+  port and streams direct (no punch-wait) — open exactly that one port. A fixed port serves one
+  session at a time (concurrent ones fall back to random + hole-punch), and direct mode needs the
+  client's reported address to be reachable (flat LAN / a non-remapping port-forward).
 
 And the **GameStream / Moonlight** ports (fixed) — only needed if you run the host with
 `serve --gamestream` (opt-in, trusted LAN only); bare `serve` is native-only and doesn't open these:
@@ -100,7 +108,9 @@ sudo ufw allow 9777/udp                                 # punktfunk/1 control pl
 sudo ufw allow 47984/tcp && sudo ufw allow 47989/tcp && sudo ufw allow 48010/tcp
 sudo ufw allow 47998,47999,48000/udp                    # GameStream video/control/audio
 sudo ufw allow 5353/udp                                 # mDNS discovery
-# The punktfunk/1 data plane is an ephemeral UDP port the host hole-punches — nothing to open here.
+# The punktfunk/1 data plane uses a random UDP port; leave it closed on a LAN — the host hole-punches
+# and falls back (~2.5s at session start if firewalled). To skip that, pin it: `serve --data-port
+# 9778` and `ufw allow 9778/udp`.
 ```
 
 With raw `nftables` (add to your `inet filter input` chain):
@@ -109,7 +119,8 @@ With raw `nftables` (add to your `inet filter input` chain):
 udp dport 9777 accept                  # punktfunk/1 control plane
 tcp dport { 47984, 47989, 48010 } accept
 udp dport { 47998-48010, 5353 } accept
-# plus the ephemeral punktfunk/1 data port (a reserved UDP range).
+# The punktfunk/1 data plane is a random UDP port — normally left closed (hole-punch + ~2.5s
+# fallback). Pin it with `serve --data-port <PORT>` to open exactly one instead.
 ```
 
 ## Updates