docs(dist): end-user install front door + serve/pairing/firewall accuracy fixes

Make the host docs match the real distribution path and the actual CLI. Reviewed by a
multi-agent pass (6 editors against one verified fact sheet + an accuracy reviewer); its
findings (a wrong client-Recommends claim, a native-concurrency overstatement) folded in.

- Install front door: new README "Install (host)" method-picker + docs-site/install.md
  (+ nav), routing each distro to its package registry; source build demoted to a fallback.
- Registry-first install: ubuntu-gnome/ubuntu-kde now lead with the apt registry (not a
  cargo build); bazzite leads with the Gitea RPM registry (was COPR/source). Source builds
  moved to an appendix.
- CLI accuracy: serve --native arms pairing from the web console (NOT --allow-pairing, which
  with --require-pairing/--max-concurrent is m3-host-only); --open disables mandatory pairing.
  host-cli/configuration/pairing/quickstart/troubleshooting corrected; mgmt API documented as
  always HTTPS+token. Native host serves one session at a time (extras queue) — not multi.
- Firewall: real ports documented (native UDP 9777 + the ephemeral data port caveat +
  GameStream ports) for Debian + Arch (ufw + nftables), not just Bazzite.
- Sync/accuracy: punktfunk-client (GTK4) presented as a shipping client (not "roadmap"),
  punktfunk-client-rs as the headless tool; host Recommends punktfunk-web only (not the
  client); COPR chroots f43/44; bootc header says Gitea registry not COPR.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs-site/content/docs/configuration.md

@@ -43,12 +43,13 @@ The client requests a bitrate; the host encodes to it. To find a good value for
 
 ## Multiple devices at once
 
-A host can stream to several clients simultaneously — each gets its own virtual display at its own
-resolution. This is the natural way to put your desktop on a laptop *and* a TV at the same time (both
-see and control the same desktop).
+Today the native `punktfunk/1` host (`serve --native`) streams **one session at a time** — additional
+clients wait in the accept queue until the active session ends. Each session gets its own virtual
+display at the client's exact resolution; concurrent native sessions are on the roadmap.
 
-The number of simultaneous streams is bounded by your GPU's encoder. Cap it with
-`--max-concurrent N` on the host command line (default 4); extra clients wait until a slot frees.
+(`m3-host`, the standalone test host, has a `--max-concurrent N` knob, default 4, bounded by your
+GPU's encoder — see the [Host CLI](/docs/host-cli) reference — but `serve --native` does **not** take
+that flag.)
 
 ## Codec and FEC