feat(web): consolidate paired devices, self-contained sections, docs + lint

Web console
- Pairing/Library/Stats refactored into self-contained subsections that each own
  their own queries + mutations; a shared slot-based layout (view.tsx) is filled by
  the live page (containers) and Storybook (pure cards + fixtures) so the layout can't
  drift.
- All paired devices in one list on Pairing with a protocol column (punktfunk/1 +
  Moonlight), routing each unpair to the right endpoint; the redundant Clients page is
  removed.
- Library: overview grid split from the add/edit form into separate files.
- Login screen links out to the docs.

Docs
- "Console login password" section on every host page (apt/RPM/Bazzite/SteamOS/Windows)
  plus a new "Forgot your Password?" troubleshooting page, linked from the login screen.
- Console served as HTTP/1.1 over TLS (drop the unusable HTTP/3 advertising) across the
  Bun entry, launchers, systemd units, and packaging.

Tooling
- Biome now respects .gitignore (stops linting generated code), config migrated to
  2.5.1; all lint issues fixed cleanly.

Also includes this branch's in-progress host, Apple client, packaging, and CI changes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

clients/apple/Sources/PunktfunkClient/SettingsView.swift

@@ -711,8 +711,8 @@ struct SettingsView: View {
         } footer: {
             Text("Adds a “Browse Library…” action to each host that lists its games "
                 + "(Steam + custom) via the host's management API; tap a title to launch it. "
-                + "The host must expose that API on the LAN with a token "
-                + "(serve --mgmt-bind 0.0.0.0 --mgmt-token …).")
+                + "Works once you've paired with the host — the library is authorized by this "
+                + "device's certificate, with no extra host setup.")
                 .font(.geist(12, relativeTo: .caption))
                 .foregroundStyle(.secondary)
         }

clients/apple/Sources/PunktfunkKit/LibraryClient.swift

@@ -3,10 +3,11 @@
 // /library page renders. Read-only on the client for now; launching a chosen title is a later
 // step. Gated behind `DefaultsKey.libraryEnabled` in the UI.
 //
-// The management API is HTTP on a port distinct from the punktfunk/1 data plane (default 47990),
-// binds loopback unless started with a token, and REQUIRES a bearer token for any non-loopback
-// bind. So to browse a host's library remotely the host must expose the mgmt API on the LAN with
-// `--mgmt-token`; the client carries that token per host. This mirrors the GameEntry/Artwork/
+// The management API serves HTTPS on a port distinct from the punktfunk/1 data plane (default
+// 47990, also advertised in the host's mDNS `mgmt` TXT). A paired client is authorized for the
+// read-only library route by its **mTLS certificate** — no bearer token. The host binds this read
+// surface to the LAN by DEFAULT (the bearer-gated admin surface stays loopback-only), so a paired
+// client browses a host's library with no operator step. This mirrors the GameEntry/Artwork/
 // LaunchSpec schema in `crates/punktfunk-host/src/library.rs`.
 
 import Foundation
@@ -56,8 +57,9 @@ public enum LibraryError: LocalizedError {
         case .http(let code):
             return "The management API returned HTTP \(code)."
         case .unreachable(let why):
-            return "Couldn't reach the host's management API: \(why). The host must expose it on "
-                + "the LAN (serve --mgmt-bind 0.0.0.0)."
+            return "Couldn't reach the host's management API: \(why). It binds the LAN by default, "
+                + "so check the host is updated and reachable (a host pinned to "
+                + "`--mgmt-bind 127.0.0.1` is loopback-only and can't be browsed remotely)."
         }
     }
 }