feat(web): consolidate paired devices, self-contained sections, docs + lint

Web console
- Pairing/Library/Stats refactored into self-contained subsections that each own
  their own queries + mutations; a shared slot-based layout (view.tsx) is filled by
  the live page (containers) and Storybook (pure cards + fixtures) so the layout can't
  drift.
- All paired devices in one list on Pairing with a protocol column (punktfunk/1 +
  Moonlight), routing each unpair to the right endpoint; the redundant Clients page is
  removed.
- Library: overview grid split from the add/edit form into separate files.
- Login screen links out to the docs.

Docs
- "Console login password" section on every host page (apt/RPM/Bazzite/SteamOS/Windows)
  plus a new "Forgot your Password?" troubleshooting page, linked from the login screen.
- Console served as HTTP/1.1 over TLS (drop the unusable HTTP/3 advertising) across the
  Bun entry, launchers, systemd units, and packaging.

Tooling
- Biome now respects .gitignore (stops linting generated code), config migrated to
  2.5.1; all lint issues fixed cleanly.

Also includes this branch's in-progress host, Apple client, packaging, and CI changes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs-site/content/docs/forgot-password.md

@@ -0,0 +1,60 @@
+---
+title: Forgot your Password?
+description: Where the punktfunk web console login password lives — and how to read or reset it — on each host platform.
+---
+
+The punktfunk **web console** (status, paired devices, PIN pairing) is protected by a login
+password. That password is generated — or, on Windows, chosen — when the console is first set up, and
+it lives on the **host**. So if you can't get past the login screen, you recover or change it on the
+host machine itself, not from the browser.
+
+> This is **only** the web console login. It is **not** your client/device pairing — if a client
+> won't connect, that's [Pairing](/docs/pairing), not this password.
+
+## Find your host
+
+Jump to your host platform for exactly where the password lives and how to read or reset it:
+
+| Host | Where the password lives | Section |
+|------|--------------------------|---------|
+| **Ubuntu — GNOME** | `~/.config/punktfunk/web-password` | [Console login password](/docs/ubuntu-gnome#console-login-password) |
+| **Ubuntu — KDE Plasma** | `~/.config/punktfunk/web-password` | [Console login password](/docs/ubuntu-kde#console-login-password) |
+| **Fedora — KDE Plasma** | `~/.config/punktfunk/web-password` | [Console login password](/docs/fedora-kde#console-login-password) |
+| **Bazzite — gamescope** | `~/.config/punktfunk/web-password` | [Console login password](/docs/bazzite#console-login-password) |
+| **SteamOS (host)** | `~/.config/punktfunk/web.env` | [Console login password](/docs/steamos-host#console-login-password) |
+| **Windows host** | `%ProgramData%\punktfunk\web-password` | [Console login password](/docs/windows-host#console-login-password) |
+
+## The short version
+
+**Linux packages (apt / RPM / Bazzite).** The password is generated on first start and saved to
+`~/.config/punktfunk/web-password`. Read it back:
+
+```sh
+# from the init service's journal (printed once, when it was generated):
+journalctl --user -u punktfunk-web-init | sed -n 's/.*password generated: //p'
+# …or straight from the file:
+sed -n 's/^PUNKTFUNK_UI_PASSWORD=//p' ~/.config/punktfunk/web-password
+```
+
+Change it by editing that file (`PUNKTFUNK_UI_PASSWORD=<your-password>`) and restarting the console:
+`systemctl --user restart punktfunk-web`.
+
+**SteamOS / Steam Deck.** Same idea, but the installer writes it to `~/.config/punktfunk/web.env`
+and prints it at the end of the install run:
+
+```sh
+sed -n 's/^PUNKTFUNK_UI_PASSWORD=//p' ~/.config/punktfunk/web.env
+```
+
+Edit that file and `systemctl --user restart punktfunk-web` to change it.
+
+**Windows.** You pick the password during install (a secure random default is pre-filled and shown
+on the installer's final page). It lives in `%ProgramData%\punktfunk\web-password`. To change it,
+edit the file and restart the **PunktfunkWeb** task — in an **elevated** PowerShell:
+
+```powershell
+notepad "$env:ProgramData\punktfunk\web-password"   # set PUNKTFUNK_UI_PASSWORD=<your-password>
+schtasks /End /TN PunktfunkWeb; schtasks /Run /TN PunktfunkWeb
+```
+
+Still stuck? See [Troubleshooting](/docs/troubleshooting).