feat(web): consolidate paired devices, self-contained sections, docs + lint

Web console
- Pairing/Library/Stats refactored into self-contained subsections that each own
  their own queries + mutations; a shared slot-based layout (view.tsx) is filled by
  the live page (containers) and Storybook (pure cards + fixtures) so the layout can't
  drift.
- All paired devices in one list on Pairing with a protocol column (punktfunk/1 +
  Moonlight), routing each unpair to the right endpoint; the redundant Clients page is
  removed.
- Library: overview grid split from the add/edit form into separate files.
- Login screen links out to the docs.

Docs
- "Console login password" section on every host page (apt/RPM/Bazzite/SteamOS/Windows)
  plus a new "Forgot your Password?" troubleshooting page, linked from the login screen.
- Console served as HTTP/1.1 over TLS (drop the unusable HTTP/3 advertising) across the
  Bun entry, launchers, systemd units, and packaging.

Tooling
- Biome now respects .gitignore (stops linting generated code), config migrated to
  2.5.1; all lint issues fixed cleanly.

Also includes this branch's in-progress host, Apple client, packaging, and CI changes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packaging/copr/README.md

@@ -36,10 +36,11 @@ parallelism with `CARGO_BUILD_JOBS` in the spec's `%build`.
 
 ## The web console subpackage (`punktfunk-web`)
 
-The spec can also build the management web console as a noarch `punktfunk-web` subpackage, but it's
-gated behind `%bcond_with web` and **OFF by default** — building the Nitro/Node SSR bundle needs
-`bun`, which COPR's mock chroot does not provide. So a stock COPR build produces only `punktfunk`
-+ `punktfunk-client`.
+The spec can also build the management web console as a `punktfunk-web` subpackage, but it's
+gated behind `%bcond_with web` and **OFF by default** — building (and now *running*) the Nitro
+console needs `bun`, which COPR's mock chroot does not provide. The package vendors the build env's
+bun binary (the console serves HTTPS — HTTP/1.1 over TLS — via `Bun.serve`), so it is arch-specific, not noarch.
+A stock COPR build produces only `punktfunk` + `punktfunk-client`.
 
 Two ways to get the console:
 - **Recommended:** install it from the Gitea RPM registry (`packaging/rpm/README.md`, Option A),