fix: keep the stream view's identity stable across the trust prompt

The awaiting-trust and streaming phases rendered StreamView in different switch
branches, so confirming trust dismantled and recreated the NSView — the fresh pump had
already missed the opening IDR (infinite GOP: no other keyframe ever comes) and decoded
nothing. One session branch now hosts a single StreamView; the trust card is an overlay
on the blurred stream and only the capturesCursor flag flips on confirmation.

Verified live against the box (gamescope+vkcube at 720p60, 11.7 Mb/s on glass). Note for
host runs: without PUNKTFUNK_COMPOSITOR=gamescope + PUNKTFUNK_GAMESCOPE_APP, m3-host
auto-picks KWin and streams its (black, empty) session — looks identical to a client
bug but isn't one.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

clients/apple/Sources/PunktfunkClient/ContentView.swift

@@ -19,19 +19,42 @@ struct ContentView: View {
 
     var body: some View {
         Group {
-            switch model.phase {
-            case .idle, .connecting:
+            // The stream view's structural identity MUST be stable across the
+            // awaiting-trust → streaming transition: recreating it restarts the pump,
+            // which has then already missed the opening IDR (infinite GOP — no other
+            // keyframe ever comes) and decodes nothing. So: one branch per connection,
+            // trust prompt as an overlay.
+            if model.connection != nil {
+                sessionView
+            } else {
                 home
-            case .awaitingTrust(let fingerprint):
-                trustPrompt(fingerprint)
-            case .streaming:
-                stream(capturesCursor: true)
             }
         }
         .onAppear { autoConnectIfAsked() }
         .onDisappear { model.disconnect() } // window closed mid-session (Cmd+N spawns more)
     }
 
+    private var sessionView: some View {
+        let pendingFingerprint: Data? = {
+            if case .awaitingTrust(let fp) = model.phase { return fp }
+            return nil
+        }()
+        return ZStack {
+            stream(capturesCursor: pendingFingerprint == nil)
+                .blur(radius: pendingFingerprint != nil ? 32 : 0)
+                .overlay {
+                    if pendingFingerprint != nil {
+                        Color.black.opacity(0.45)
+                    }
+                }
+            if let fp = pendingFingerprint {
+                trustCard(fp)
+            }
+        }
+        .frame(minWidth: 640, minHeight: 360)
+        .background(Color.black)
+    }
+
     // MARK: - Home (hosts grid)
 
     private var home: some View {
@@ -156,13 +179,7 @@ struct ContentView: View {
 
     // MARK: - Trust on first use
 
-    private func trustPrompt(_ fingerprint: Data) -> some View {
-        ZStack {
-            // Keep the stream pumping (the opening IDR must be consumed) but blurred and
-            // cursor-free until the host is verified.
-            stream(capturesCursor: false)
-                .blur(radius: 32)
-                .overlay(.black.opacity(0.45))
+    private func trustCard(_ fingerprint: Data) -> some View {
         VStack(spacing: 14) {
             Image(systemName: "lock.shield")
                 .font(.system(size: 36, weight: .light))
@@ -195,9 +212,6 @@ struct ContentView: View {
         .frame(maxWidth: 440)
         .background(.regularMaterial, in: RoundedRectangle(cornerRadius: 18))
     }
-        .frame(minWidth: 640, minHeight: 360)
-        .background(Color.black)
-    }
 
     /// 64 hex chars → four groups per line, two lines — easy to eyeball against the log.
     private static func format(fingerprint: Data) -> String {
@@ -226,8 +240,6 @@ struct ContentView: View {
                 .overlay(alignment: .topTrailing) {
                     if capturesCursor { hud(conn) }
                 }
-                .frame(minWidth: 640, minHeight: 360)
-                .background(Color.black)
             }
         }
     }