feat(core): every connect introduces the device by name

The wire always had Hello.name and the host always honored it - but the
connect path hardcoded None (only the PIN-pairing ceremony sent a name),
so every no-PIN "request access" knock surfaced as the fingerprint
placeholder "device abcd1234", and approving one without retyping a
name persisted that placeholder into the trust store forever.

NativeClient::connect now takes the device name. The session workers
and the probe connects pass trust::device_name() (the hostname), the C
ABI defaults to the same without a signature change (an ex10 variant
can make it explicit if an embedder wants a custom label), and Android
threads Build.MODEL through nativeConnect - the same convention its
pairing dialogs already use for nativePair.

The host, in turn, resolves the streaming client's display name (trust
store first, so an approval-time rename wins; else the sanitized Hello
name) and exposes it as client_name in GET /api/v1/local/summary for
the tray's connect toast - a deliberate, documented loosening of that
route's "no device names" contract, in the local user's favor: it tells
them who is on their machine. A paired-but-idle device's name still
never appears, which the mgmt tests now pin explicitly. openapi.json,
its docs-site copy, and the SDK bindings regenerate.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

clients/linux/src/app.rs

@@ -699,6 +699,9 @@ impl AppModel {
                     None, // display_hdr: probe connect, nothing presents
                     0,    // client_caps: probe connect, nothing renders a cursor
                     None, // launch: probe connect, no game
+                    // Knock under this device's name, not a fingerprint placeholder, when the
+                    // probed host doesn't know us yet.
+                    Some(pf_client_core::trust::device_name()),
                     pin,
                     Some(identity),
                     std::time::Duration::from_secs(15),