feat(web): consolidate paired devices, self-contained sections, docs + lint

Web console
- Pairing/Library/Stats refactored into self-contained subsections that each own
  their own queries + mutations; a shared slot-based layout (view.tsx) is filled by
  the live page (containers) and Storybook (pure cards + fixtures) so the layout can't
  drift.
- All paired devices in one list on Pairing with a protocol column (punktfunk/1 +
  Moonlight), routing each unpair to the right endpoint; the redundant Clients page is
  removed.
- Library: overview grid split from the add/edit form into separate files.
- Login screen links out to the docs.

Docs
- "Console login password" section on every host page (apt/RPM/Bazzite/SteamOS/Windows)
  plus a new "Forgot your Password?" troubleshooting page, linked from the login screen.
- Console served as HTTP/1.1 over TLS (drop the unusable HTTP/3 advertising) across the
  Bun entry, launchers, systemd units, and packaging.

Tooling
- Biome now respects .gitignore (stops linting generated code), config migrated to
  2.5.1; all lint issues fixed cleanly.

Also includes this branch's in-progress host, Apple client, packaging, and CI changes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs-site/content/docs/fedora-kde.md

@@ -111,6 +111,30 @@ journalctl --user -u punktfunk-host -f          # watch a client connect
 The host now listens on `9777` (native punktfunk/1) + the GameStream ports, and advertises over
 mDNS. It requires **PIN pairing** by default (secure on a LAN); pair once from your client.
 
+### Web console
+
+The console (status, paired devices, arm pairing) ships as `punktfunk-web` — enable it, then open
+`http://<host-ip>:3000`:
+
+```sh
+systemctl --user enable --now punktfunk-web
+```
+
+#### Console login password
+
+The console is password-protected. On first start `punktfunk-web-init` generates a random login
+password and saves it to `~/.config/punktfunk/web-password` (as `PUNKTFUNK_UI_PASSWORD=…`). Read it
+back at any time — from the init service's journal, or straight from the file:
+
+```sh
+journalctl --user -u punktfunk-web-init | sed -n 's/.*password generated: //p'
+sed -n 's/^PUNKTFUNK_UI_PASSWORD=//p' ~/.config/punktfunk/web-password
+```
+
+To set your own password, edit that file (`PUNKTFUNK_UI_PASSWORD=<your-password>`) and restart the
+console: `systemctl --user restart punktfunk-web`. Forgot it? This is the recovery path linked from
+the console login screen — see [Forgot your Password?](/docs/forgot-password).
+
 ## 4. Connect a client
 
 From any [client](/docs/clients) — `punktfunk-client --discover` finds the host on the LAN. On