docs(dist): end-user install front door + serve/pairing/firewall accuracy fixes

Make the host docs match the real distribution path and the actual CLI. Reviewed by a
multi-agent pass (6 editors against one verified fact sheet + an accuracy reviewer); its
findings (a wrong client-Recommends claim, a native-concurrency overstatement) folded in.

- Install front door: new README "Install (host)" method-picker + docs-site/install.md
  (+ nav), routing each distro to its package registry; source build demoted to a fallback.
- Registry-first install: ubuntu-gnome/ubuntu-kde now lead with the apt registry (not a
  cargo build); bazzite leads with the Gitea RPM registry (was COPR/source). Source builds
  moved to an appendix.
- CLI accuracy: serve --native arms pairing from the web console (NOT --allow-pairing, which
  with --require-pairing/--max-concurrent is m3-host-only); --open disables mandatory pairing.
  host-cli/configuration/pairing/quickstart/troubleshooting corrected; mgmt API documented as
  always HTTPS+token. Native host serves one session at a time (extras queue) — not multi.
- Firewall: real ports documented (native UDP 9777 + the ephemeral data port caveat +
  GameStream ports) for Debian + Arch (ufw + nftables), not just Bazzite.
- Sync/accuracy: punktfunk-client (GTK4) presented as a shipping client (not "roadmap"),
  punktfunk-client-rs as the headless tool; host Recommends punktfunk-web only (not the
  client); COPR chroots f43/44; bootc header says Gitea registry not COPR.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs-site/content/docs/clients.md

@@ -3,7 +3,8 @@ title: Clients
 description: The ways to connect to a punktfunk host — the Apple app, Moonlight, or the Linux client.
 ---
 
-A punktfunk host accepts two kinds of client. Pick whichever fits the device you're streaming *to*.
+A punktfunk host accepts clients over its own `punktfunk/1` protocol (the Apple and Linux apps) and
+over GameStream (Moonlight). Pick whichever fits the device you're streaming *to*.
 
 ## Apple app (Mac, iPhone, iPad, Apple TV)
 
@@ -28,24 +29,49 @@ software. See [Connect with Moonlight](/docs/moonlight).
 This is the broadest-compatibility option and great for couch gaming. It doesn't use the native
 protocol's FEC/encryption extensions, but for a healthy LAN that rarely matters.
 
-## Linux reference client
+## Linux desktop client (GTK4)
 
-`punktfunk-client-rs` (in the repo) is a command-line client for the native protocol, mainly for
-testing and development. It connects, streams to a file, runs the speed test, and can discover hosts:
+`punktfunk-client` is the native graphical Linux client — a GTK4 / libadwaita app that speaks
+`punktfunk/1` directly, with hardware decode (VAAPI → dmabuf on Intel/AMD, software fallback),
+PipeWire audio, and SDL3 controllers (rumble, lightbar, DualSense touchpad/motion). Like the Apple
+app it discovers hosts on your network automatically, does PIN pairing, and pins reconnects.
+
+It ships as a real package, not just a source build:
+
+- **Ubuntu / Debian** — `apt install punktfunk-client` from the punktfunk apt registry
+  (see `packaging/debian/README.md`).
+- **Fedora / Bazzite** — `rpm-ostree install punktfunk-client` from the Gitea RPM registry
+  (see `packaging/rpm/README.md`).
+- **Arch / SteamOS** — the `punktfunk-client` split package from the `PKGBUILD`
+  (see `packaging/arch/README.md`).
+- **Steam Deck / any Flatpak distro** — the `io.unom.Punktfunk` Flatpak bundle
+  (see `packaging/flatpak/README.md`); this is what the Decky plugin launches.
+
+Launch it, pick your host from the list, and stream. For scripting you can skip the host list and
+connect straight away:
 
 ```sh
-punktfunk-client-rs --discover                       # list hosts on the network
-punktfunk-client-rs --connect <host>:9777 --pin <fp> # connect to one
+punktfunk-client --connect <host>:9777   # skip the picker, start a session immediately
 ```
 
-A full graphical Linux client (hardware decode + present) is on the [roadmap](/docs/roadmap).
+## Linux reference client (headless)
+
+`punktfunk-client-rs` (in the repo) is a command-line client for the native protocol, used for
+testing, development, and latency measurement — not an everyday client. It connects, streams to a
+file, runs the speed test, and can discover hosts:
+
+```sh
+punktfunk-client-rs --discover                        # list hosts on the network
+punktfunk-client-rs --connect <host>:9777 --pin <fp>  # connect to one
+```
 
 ## Which should I use?
 
 | You're streaming to… | Use |
 |---|---|
 | A Mac, iPhone, iPad, or Apple TV | The **Apple app** |
-| Windows, Android, Steam Deck, a browser, a TV | **Moonlight** |
-| Another Linux box (testing) | **`punktfunk-client-rs`** |
+| A Linux desktop or laptop, or a Steam Deck | **`punktfunk-client`** (GTK4) |
+| Windows, Android, a browser, a TV | **Moonlight** |
+| Automated tests / latency measurement | **`punktfunk-client-rs`** (headless) |
 
 Whichever you choose, the first connection needs a one-time [pairing](/docs/pairing).