feat(web): consolidate paired devices, self-contained sections, docs + lint

Web console
- Pairing/Library/Stats refactored into self-contained subsections that each own
  their own queries + mutations; a shared slot-based layout (view.tsx) is filled by
  the live page (containers) and Storybook (pure cards + fixtures) so the layout can't
  drift.
- All paired devices in one list on Pairing with a protocol column (punktfunk/1 +
  Moonlight), routing each unpair to the right endpoint; the redundant Clients page is
  removed.
- Library: overview grid split from the add/edit form into separate files.
- Login screen links out to the docs.

Docs
- "Console login password" section on every host page (apt/RPM/Bazzite/SteamOS/Windows)
  plus a new "Forgot your Password?" troubleshooting page, linked from the login screen.
- Console served as HTTP/1.1 over TLS (drop the unusable HTTP/3 advertising) across the
  Bun entry, launchers, systemd units, and packaging.

Tooling
- Biome now respects .gitignore (stops linting generated code), config migrated to
  2.5.1; all lint issues fixed cleanly.

Also includes this branch's in-progress host, Apple client, packaging, and CI changes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packaging/arch/PKGBUILD

@@ -30,7 +30,7 @@ license=('MIT OR Apache-2.0')
 makedepends=('rust' 'cargo' 'clang' 'cmake' 'nasm' 'pkgconf' 'git'
              'gtk4' 'libadwaita' 'sdl3' 'ffmpeg' 'pipewire' 'wayland' 'libxkbcommon' 'opus' 'libei')
 
-# Opt-in punktfunk-web: only then is bun (build tool; the console runs on plain nodejs) required.
+# Opt-in punktfunk-web: only then is bun (the build tool AND the vendored runtime) required.
 if [ "${PF_WITH_WEB:-0}" = 1 ]; then
   pkgname+=('punktfunk-web')
   makedepends+=('bun')   # `bun-bin` from the AUR if bun isn't in your configured repos
@@ -51,7 +51,8 @@ build() {
   # NVIDIA builder. On a GPU-less builder symlink the CUDA stub into the link path first (same
   # caveat the RPM documents): ln -s "$(find / -name libcuda.so -path '*stubs*'|head -1)" /usr/lib/
   cargo build --release --locked -p punktfunk-host -p punktfunk-client-linux
-  # Management web console (opt-in): the node-server .output bundle (built with bun, run with node).
+  # Management web console (opt-in): the Nitro `bun`-preset .output bundle (Bun.serve TLS),
+  # built AND run with bun.
   if [ "${PF_WITH_WEB:-0}" = 1 ]; then
     ( cd web && bun install --frozen-lockfile && bun run build )
   fi
@@ -138,19 +139,21 @@ package_punktfunk-client() {
 }
 
 package_punktfunk-web() {
-  pkgdesc="punktfunk management web console (Nitro/Node SSR) — pairing + status in the browser"
-  arch=('any')
-  # Runtime is plain node (the .output is portable JS — bun was only the build tool). Auto-wired to
-  # the host's mgmt token via the systemd --user units; enable with `systemctl --user enable --now punktfunk-web`.
-  depends=('nodejs')
+  pkgdesc="punktfunk management web console (Nitro SSR on bun, HTTPS/HTTP-1.1 over TLS) — pairing + status in the browser"
+  # bun is the runtime (Bun.serve), and it's a native binary we vendor, so this package is
+  # arch-specific (not 'any'). Auto-wired to the host's mgmt token + identity cert via the systemd
+  # --user units; enable with `systemctl --user enable --now punktfunk-web`. No nodejs/bun dependency.
   local R; R="$(_repo)"
 
-  # Pre-built node-server bundle (from build()) + a PATH-stable launcher (matches the .deb/.rpm).
+  # Pre-built bun-preset bundle (from build()) + a PATH-stable launcher (matches the .deb/.rpm).
   install -d "$pkgdir/usr/share/punktfunk-web/.output"
   cp -r "$R/web/.output/server" "$pkgdir/usr/share/punktfunk-web/.output/server"
   cp -r "$R/web/.output/public" "$pkgdir/usr/share/punktfunk-web/.output/public"
+  # Vendor the build env's bun into a private dir so it never collides with a
+  # system-wide bun on PATH.
+  install -Dm0755 "$(command -v bun)" "$pkgdir/usr/lib/punktfunk-web/bun"
   install -d "$pkgdir/usr/bin"
-  printf '%s\n' '#!/bin/sh' 'exec /usr/bin/node /usr/share/punktfunk-web/.output/server/index.mjs "$@"' \
+  printf '%s\n' '#!/bin/sh' 'exec /usr/lib/punktfunk-web/bun /usr/share/punktfunk-web/.output/server/index.mjs "$@"' \
     > "$pkgdir/usr/bin/punktfunk-web-server"
   chmod 0755 "$pkgdir/usr/bin/punktfunk-web-server"
   # systemd USER units: the console runs per-user; web-init generates the login password on first start.

packaging/arch/README.md

@@ -14,8 +14,9 @@ scripts. On a **Steam Deck used as a client you want `punktfunk-client`** (it's
 
 A third member, **`punktfunk-web`** (the browser management console — pairing + status), is
 **opt-in**: build it by setting `PF_WITH_WEB=1`, which requires **`bun`** at build time (`bun-bin`
-from the AUR if it isn't in your repos; the console then runs on plain `nodejs`). A default
-`makepkg` builds only host+client with no JS tooling — mirroring the RPM spec's `%bcond_with web`.
+from the AUR if it isn't in your repos). bun is also the **runtime** — the console serves HTTPS
+(HTTP/1.1 over TLS) via `Bun.serve`, so the package vendors the bun binary (no `nodejs` dependency). A
+default `makepkg` builds only host+client with no JS tooling — mirroring the RPM spec's `%bcond_with web`.
 
 > **Host encode: NVENC on NVIDIA, VAAPI on AMD/Intel** (`PUNKTFUNK_ENCODER=auto` picks one). The host
 > now has a VAAPI encoder + zero-copy dmabuf path alongside NVENC/CUDA, so `punktfunk-host` works on
@@ -41,7 +42,7 @@ cp /usr/share/punktfunk/host.env.bazzite ~/.config/punktfunk/host.env   # gamesc
 systemctl --user enable --now punktfunk-host
 # Web console (if you installed the punktfunk-web package): enable it + read the login password.
 systemctl --user enable --now punktfunk-web
-journalctl --user -u punktfunk-web-init | sed -n 's/.*password generated: //p'   # open http://<host-ip>:3000
+journalctl --user -u punktfunk-web-init | sed -n 's/.*password generated: //p'   # open https://<host-ip>:3000
 ```
 NVENC/EGL come from the NVIDIA driver: `sudo pacman -S --needed nvidia-utils`. Arch's stock
 `ffmpeg` already has NVENC built in — no RPM-Fusion-style swap needed (unlike Fedora).