feat(web): consolidate paired devices, self-contained sections, docs + lint

Web console
- Pairing/Library/Stats refactored into self-contained subsections that each own
  their own queries + mutations; a shared slot-based layout (view.tsx) is filled by
  the live page (containers) and Storybook (pure cards + fixtures) so the layout can't
  drift.
- All paired devices in one list on Pairing with a protocol column (punktfunk/1 +
  Moonlight), routing each unpair to the right endpoint; the redundant Clients page is
  removed.
- Library: overview grid split from the add/edit form into separate files.
- Login screen links out to the docs.

Docs
- "Console login password" section on every host page (apt/RPM/Bazzite/SteamOS/Windows)
  plus a new "Forgot your Password?" troubleshooting page, linked from the login screen.
- Console served as HTTP/1.1 over TLS (drop the unusable HTTP/3 advertising) across the
  Bun entry, launchers, systemd units, and packaging.

Tooling
- Biome now respects .gitignore (stops linting generated code), config migrated to
  2.5.1; all lint issues fixed cleanly.

Also includes this branch's in-progress host, Apple client, packaging, and CI changes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

crates/punktfunk-host/src/gamestream/mod.rs

@@ -238,7 +238,7 @@ pub fn serve(
             tokio::try_join!(
                 nvhttp::run(state.clone()),
                 crate::mgmt::run(state.clone(), mgmt, Some(np.clone()), stats.clone()),
-                crate::punktfunk1::serve(native_opts, np, stats.clone()),
+                crate::punktfunk1::serve(native_opts, native.mgmt_port, np, stats.clone()),
             )?;
         } else {
             // Secure default: native punktfunk/1 + management API only (no GameStream surface).
@@ -249,7 +249,7 @@ pub fn serve(
             );
             tokio::try_join!(
                 crate::mgmt::run(state.clone(), mgmt, Some(np.clone()), stats.clone()),
-                crate::punktfunk1::serve(native_opts, np, stats.clone()),
+                crate::punktfunk1::serve(native_opts, native.mgmt_port, np, stats.clone()),
             )?;
         }
         Ok(())

crates/punktfunk-host/src/gamestream/rtsp.rs

@@ -350,7 +350,17 @@ fn stream_config(map: &HashMap<String, String>) -> Option<StreamConfig> {
     let fps = parse_u("x-nv-video[0].maxFPS")
         .filter(|&f| f > 0)
         .unwrap_or(60);
-    let bitrate_kbps = parse_u("x-nv-vqos[0].bw.maximumBitrateKbps").unwrap_or(20_000);
+    // Bitrate: Moonlight caps the legacy `x-nv-vqos[0].bw.*` fields at 100 Mbps for old-GFE
+    // compatibility and carries the user's REAL (uncapped) configured bitrate in the moonlight-specific
+    // `x-ml-video.configuredBitrateKbps`. Read that first — exactly like Sunshine — so a 500 Mbps client
+    // setting isn't silently floored to 100. Fall back to the legacy max for clients that don't send it,
+    // then a conservative default; clamp to a sane ceiling (the RTSP ANNOUNCE is attacker-controlled).
+    const MAX_BITRATE_KBPS: u32 = 1_000_000; // 1 Gbps — well above Moonlight's 500 Mbps slider
+    let bitrate_kbps = parse_u("x-ml-video.configuredBitrateKbps")
+        .filter(|&b| b > 0)
+        .or_else(|| parse_u("x-nv-vqos[0].bw.maximumBitrateKbps").filter(|&b| b > 0))
+        .unwrap_or(20_000)
+        .min(MAX_BITRATE_KBPS);
     // Client codec choice (moonlight-common-c SdpGenerator.c): 0=H264, 1=HEVC, 2=AV1.
     let codec = match map.get("x-nv-vqos[0].bitStreamFormat").map(|s| s.trim()) {
         Some("1") => Codec::H265,
@@ -496,6 +506,26 @@ mod tests {
         }
     }
 
+    /// Bitrate precedence: the moonlight-specific `x-ml-video.configuredBitrateKbps` (the user's real,
+    /// uncapped setting) wins over the legacy `x-nv-vqos[0].bw.maximumBitrateKbps` (which Moonlight floors
+    /// at 100 Mbps for old-GFE compat). Without this a 500 Mbps client streamed at 100.
+    #[test]
+    fn announce_prefers_configured_bitrate() {
+        // Real Moonlight shape: legacy max floored at 100 Mbps, configured carrying the true 500 Mbps.
+        let map = announce(&[
+            ("x-nv-vqos[0].bw.maximumBitrateKbps", "100000"),
+            ("x-ml-video.configuredBitrateKbps", "500000"),
+        ]);
+        assert_eq!(stream_config(&map).unwrap().bitrate_kbps, 500_000);
+        // No configured field (older client) → fall back to the legacy max (the base announce's 40 Mbps).
+        assert_eq!(stream_config(&announce(&[])).unwrap().bitrate_kbps, 40_000);
+        // A zero configured value is ignored (falls back), and an absurd value is clamped to the ceiling.
+        let zero = announce(&[("x-ml-video.configuredBitrateKbps", "0")]);
+        assert_eq!(stream_config(&zero).unwrap().bitrate_kbps, 40_000);
+        let huge = announce(&[("x-ml-video.configuredBitrateKbps", "9000000")]);
+        assert_eq!(stream_config(&huge).unwrap().bitrate_kbps, 1_000_000);
+    }
+
     /// Missing required video keys → no config (the PLAY handler then refuses to stream).
     #[test]
     fn announce_missing_required_keys() {