refactor(apple): code-quality pass — audit fixes + centralized defaults keys

A 6-agent adversarial audit of the client (11 confirmed of 39 findings, the rest
filtered) drove these:

- fix: SessionAudio ring buffer — guard a write larger than the ring (would push
  readIdx past writeIdx and corrupt the buffer; never happens, but guard not corrupt).
- fix: CADisplayLink retain cycle (stage-2 presenter) — a weak-target DisplayLinkProxy
  so the view can deallocate (the link retains its target); stage-2 teardown added to
  both StreamView/StreamViewController deinits as a safety net.
- fix: GamepadFeedback deinit { flag.stop() } — the drain thread holds the connection
  strongly and self weakly, so an abrupt teardown without stop() would leak it.
- refactor: centralize the 12 UserDefaults/@AppStorage key literals (scattered across
  8 files) into one DefaultsKey enum — a typo silently splits a setting's reader from
  its writer.
- docs: RumbleRenderer @unchecked Sendable invariant; the HID digit-row table; the
  stage-2 layer compositing.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

clients/apple/Sources/PunktfunkKit/GamepadManager.swift

@@ -4,7 +4,7 @@
 // follow `active` — exactly ONE physical controller is forwarded to the host, as pad 0.
 //
 // Selection: the user can pin a controller in Settings (persisted under
-// "punktfunk.gamepadID"); with no pin — or the pinned one absent — the most recently
+// DefaultsKey.gamepadID); with no pin — or the pinned one absent — the most recently
 // connected extended gamepad wins. GCController has no stable hardware serial, so the pin
 // is a fingerprint of vendorName|productCategory (+ a connect-order suffix for twins);
 // identical twin controllers may swap a pin across reconnects, which the Settings footer
@@ -61,7 +61,7 @@ public final class GamepadManager: ObservableObject {
         }
     }
 
-    private static let preferredKey = "punktfunk.gamepadID"
+    private static let preferredKey = DefaultsKey.gamepadID
     /// Connect order (identity-keyed) — drives both twin de-dup suffixes and auto-pick.
     private var connectOrder: [ObjectIdentifier] = []
     private var observers: [NSObjectProtocol] = []