feat(web): consolidate paired devices, self-contained sections, docs + lint

Web console
- Pairing/Library/Stats refactored into self-contained subsections that each own
  their own queries + mutations; a shared slot-based layout (view.tsx) is filled by
  the live page (containers) and Storybook (pure cards + fixtures) so the layout can't
  drift.
- All paired devices in one list on Pairing with a protocol column (punktfunk/1 +
  Moonlight), routing each unpair to the right endpoint; the redundant Clients page is
  removed.
- Library: overview grid split from the add/edit form into separate files.
- Login screen links out to the docs.

Docs
- "Console login password" section on every host page (apt/RPM/Bazzite/SteamOS/Windows)
  plus a new "Forgot your Password?" troubleshooting page, linked from the login screen.
- Console served as HTTP/1.1 over TLS (drop the unusable HTTP/3 advertising) across the
  Bun entry, launchers, systemd units, and packaging.

Tooling
- Biome now respects .gitignore (stops linting generated code), config migrated to
  2.5.1; all lint issues fixed cleanly.

Also includes this branch's in-progress host, Apple client, packaging, and CI changes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

crates/punktfunk-host/src/windows/install.rs

@@ -226,7 +226,8 @@ fn web_setup(args: &[String]) -> Result<()> {
         bail!("web launcher missing: {}", cmd.display());
     }
     register_web_task(&cmd)?;
-    // 4. firewall: inbound TCP 3000
+    // 4. firewall: inbound TCP 3000. The console serves HTTPS (HTTP/1.1 over TLS) with the host's
+    //    identity cert. (No UDP/HTTP-3: browsers won't use QUIC against a self-signed/no-SAN cert.)
     if !run_quiet(
         "netsh",
         &[
@@ -251,7 +252,7 @@ fn web_setup(args: &[String]) -> Result<()> {
         std::thread::sleep(std::time::Duration::from_secs(1));
     }
     run_quiet("schtasks", &["/run", "/tn", WEB_TASK]);
-    println!("web console set up + started (http://<host-ip>:3000)");
+    println!("web console set up + started (https://<host-ip>:3000)");
     Ok(())
 }