feat(web): consolidate paired devices, self-contained sections, docs + lint

Web console
- Pairing/Library/Stats refactored into self-contained subsections that each own
  their own queries + mutations; a shared slot-based layout (view.tsx) is filled by
  the live page (containers) and Storybook (pure cards + fixtures) so the layout can't
  drift.
- All paired devices in one list on Pairing with a protocol column (punktfunk/1 +
  Moonlight), routing each unpair to the right endpoint; the redundant Clients page is
  removed.
- Library: overview grid split from the add/edit form into separate files.
- Login screen links out to the docs.

Docs
- "Console login password" section on every host page (apt/RPM/Bazzite/SteamOS/Windows)
  plus a new "Forgot your Password?" troubleshooting page, linked from the login screen.
- Console served as HTTP/1.1 over TLS (drop the unusable HTTP/3 advertising) across the
  Bun entry, launchers, systemd units, and packaging.

Tooling
- Biome now respects .gitignore (stops linting generated code), config migrated to
  2.5.1; all lint issues fixed cleanly.

Also includes this branch's in-progress host, Apple client, packaging, and CI changes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs-site/content/docs/windows-host.md

@@ -51,10 +51,24 @@ Packaging internals live in
 ### Web console & pairing
 
 The installer also sets up the **web management console** (status, paired devices, the PIN pairing
-flow): it bundles the console plus its own runtime and runs it as the **`PunktfunkWeb`** service on
-**`http://<this-PC>:3000`**, starting at boot. During setup you choose the console **login password**
-(pre-filled with a secure random default and shown again on the final page); change it later in
-`%ProgramData%\punktfunk\web-password`.
+flow): it bundles the console plus its own runtime and runs it as the **`PunktfunkWeb`** task on
+**`http://<this-PC>:3000`**, starting at boot.
+
+#### Console login password
+
+During setup you choose the console **login password** — it's pre-filled with a secure random default
+and shown again on the installer's final page. It's stored in `%ProgramData%\punktfunk\web-password`
+(as `PUNKTFUNK_UI_PASSWORD=…`), readable only by Administrators and SYSTEM.
+
+To change it, edit that file and restart the console task. In an **elevated** PowerShell:
+
+```powershell
+notepad "$env:ProgramData\punktfunk\web-password"   # set PUNKTFUNK_UI_PASSWORD=<your-password>
+schtasks /End /TN PunktfunkWeb; schtasks /Run /TN PunktfunkWeb
+```
+
+Forgot it? This is the recovery path linked from the console login screen — see
+[Forgot your Password?](/docs/forgot-password).
 
 The host **requires PIN pairing** by default (secure on a LAN). To connect the first time, open the
 console from any browser on the LAN, log in, go to **Devices → arm pairing**, and enter the PIN on