chore(windows): persistent build env + one-call host/web deploy scripts

scripts/windows/: setup-build-env.ps1 persists the NVENC build env (Machine scope:
PUNKTFUNK_NVENC_LIB_DIR, LIBCLANG_PATH, CMAKE_POLICY_VERSION_MINIMUM -- no FFMPEG_DIR, the
nvenc build doesn't link libavcodec). deploy-host.ps1 rebuilds --release --features nvenc and
restarts the PunktfunkHost service with .bak rollback on build/start failure. build-web.ps1
rebuilds the Nitro web console (bun build, node runtime) and restarts the PunktfunkWeb task.
README documents the flow -- a redeploy is now a single script call.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/windows/deploy-host.ps1

@@ -0,0 +1,71 @@
+<#
+  Rebuild the punktfunk Windows host (release + NVENC) from the CURRENT source and
+  restart the LocalSystem service, with automatic rollback if the build fails or the
+  new binary won't start.
+
+    powershell -ExecutionPolicy Bypass -File scripts\windows\deploy-host.ps1
+
+  Prereqs: run setup-build-env.ps1 once (persists the build env), and VS C++ build tools
+  installed (vcvars64.bat is auto-discovered via vswhere). The service is stopped for the
+  duration of the build (the running .exe is locked), then restarted on the new binary.
+#>
+$ErrorActionPreference = 'Stop'
+$repo = Split-Path (Split-Path $PSScriptRoot)        # scripts\windows -> repo root
+$exe  = Join-Path $repo 'target\release\punktfunk-host.exe'
+$bak  = "$exe.bak"
+$svc  = 'PunktfunkHost'
+
+function Find-VcVars {
+  $vswhere = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe"
+  if (Test-Path $vswhere) {
+    $ip = & $vswhere -latest -products * -property installationPath 2>$null
+    if ($ip) { $v = Join-Path $ip 'VC\Auxiliary\Build\vcvars64.bat'; if (Test-Path $v) { return $v } }
+  }
+  $fb = 'C:\Program Files\Microsoft Visual Studio\18\Community\VC\Auxiliary\Build\vcvars64.bat'
+  if (Test-Path $fb) { return $fb }
+  throw "vcvars64.bat not found - install the VS C++ build tools."
+}
+
+function Svc-Running { (& sc.exe query $svc 2>$null) -match 'RUNNING' }
+
+Write-Host "== punktfunk host deploy =="
+$vcvars = Find-VcVars
+Write-Host "vcvars : $vcvars"
+Set-Location $repo
+
+# 1. stop the service so the .exe is writable
+Write-Host "stopping $svc ..."
+& sc.exe stop $svc | Out-Null
+for ($i=0; $i -lt 30 -and (Svc-Running); $i++) { Start-Sleep 1 }
+
+# 2. back up the current binary for rollback
+if (Test-Path $exe) { Copy-Item $exe $bak -Force; Write-Host "backup : $bak" }
+
+# 3. build (release + nvenc); build env is inherited from Machine scope (setup-build-env.ps1)
+Write-Host "building: cargo build --release -p punktfunk-host --features nvenc"
+& cmd.exe /c "call `"$vcvars`" >nul && cargo build --release -p punktfunk-host --features nvenc"
+$built = ($LASTEXITCODE -eq 0)
+
+if (-not $built) {
+  Write-Warning "BUILD FAILED (exit $LASTEXITCODE) - restoring previous binary."
+  if (Test-Path $bak) { Copy-Item $bak $exe -Force }
+  & sc.exe start $svc | Out-Null
+  throw "build failed; previous binary restored and service restarted."
+}
+
+# 4. start on the new binary and confirm it stays up
+Write-Host "build OK - starting $svc ..."
+& sc.exe start $svc | Out-Null
+$running = $false
+for ($i=0; $i -lt 20; $i++) { if (Svc-Running) { $running = $true; break }; Start-Sleep 1 }
+
+if (-not $running) {
+  Write-Warning "new binary did not start - rolling back."
+  & sc.exe stop $svc | Out-Null; Start-Sleep 2
+  if (Test-Path $bak) { Copy-Item $bak $exe -Force }
+  & sc.exe start $svc | Out-Null
+  throw "new binary failed to start; rolled back to previous."
+}
+
+Write-Host "DONE - $svc running the new binary:"
+Get-Item $exe | Select-Object LastWriteTime, Length | Format-List