feat(web): consolidate paired devices, self-contained sections, docs + lint

Web console
- Pairing/Library/Stats refactored into self-contained subsections that each own
  their own queries + mutations; a shared slot-based layout (view.tsx) is filled by
  the live page (containers) and Storybook (pure cards + fixtures) so the layout can't
  drift.
- All paired devices in one list on Pairing with a protocol column (punktfunk/1 +
  Moonlight), routing each unpair to the right endpoint; the redundant Clients page is
  removed.
- Library: overview grid split from the add/edit form into separate files.
- Login screen links out to the docs.

Docs
- "Console login password" section on every host page (apt/RPM/Bazzite/SteamOS/Windows)
  plus a new "Forgot your Password?" troubleshooting page, linked from the login screen.
- Console served as HTTP/1.1 over TLS (drop the unusable HTTP/3 advertising) across the
  Bun entry, launchers, systemd units, and packaging.

Tooling
- Biome now respects .gitignore (stops linting generated code), config migrated to
  2.5.1; all lint issues fixed cleanly.

Also includes this branch's in-progress host, Apple client, packaging, and CI changes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packaging/debian/build-web-deb.sh

@@ -1,13 +1,15 @@
 #!/usr/bin/env bash
-# Build the punktfunk-web .deb — the management web console (Nitro/Node SSR + React).
+# Build the punktfunk-web .deb — the management web console (Nitro SSR on bun + React).
 #
-# Architecture: all — the .output is pre-built JS (no compiled binary, so NO dpkg-shlibdeps).
-# Runtime is apt-native: Depends on nodejs (>= 20). The host's punktfunk-host .deb Recommends this,
-# so a default `apt install punktfunk-host` pulls the console too. It is auto-wired to the host's
-# mgmt token via the systemd --user units (no env editing on a packaged install).
+# Runtime is BUN: the console is built with Nitro's `bun` preset + a custom Bun.serve entry that
+# serves HTTPS (HTTP/1.1 over TLS) with the host's identity cert (web/nitro-entry/bun-https.mjs). Bun
+# isn't in apt, so we VENDOR a bun binary into the package — which makes the
+# package per-arch (amd64/arm64), NOT `all`. The host's punktfunk-host .deb Recommends this, so a
+# default `apt install punktfunk-host` pulls the console too; it is auto-wired to the host's mgmt
+# token + identity cert via the systemd --user units (no env editing on a packaged install).
 #
-# Usage: VERSION=0.0.1~ci42.gdeadbee bash packaging/debian/build-web-deb.sh
-# Output: dist/punktfunk-web_<version>_all.deb
+# Usage: VERSION=0.0.1~ci42.gdeadbee [DEB_ARCH=amd64] [BUN_BIN=/path/to/bun] bash packaging/debian/build-web-deb.sh
+# Output: dist/punktfunk-web_<version>_<arch>.deb
 set -euo pipefail
 
 VERSION="${VERSION:?set VERSION (e.g. 0.0.1 or 0.0.1~ci42.gdeadbee)}"
@@ -15,14 +17,23 @@ PKG="punktfunk-web"
 ROOTDIR="$(cd "$(dirname "$0")/../.." && pwd)"
 cd "$ROOTDIR"
 
+# Per-arch: vendor bun for the target Debian arch. Map deb arch → bun's release arch tag.
+DEB_ARCH="${DEB_ARCH:-$(dpkg --print-architecture)}"
+BUN_VERSION="${BUN_VERSION:-1.3.14}" # pinned bun build vendored into the package
+case "$DEB_ARCH" in
+  amd64) BUN_ARCH=x64 ;;
+  arm64) BUN_ARCH=aarch64 ;;
+  *) echo "ERROR: unsupported DEB_ARCH=$DEB_ARCH (want amd64 or arm64)" >&2; exit 1 ;;
+esac
+
 # Build the console if not already built (.output is gitignored — CI builds it each run).
 if [ ! -f web/.output/server/index.mjs ]; then
   echo "==> building web console"
   (cd web && bun install --frozen-lockfile && bun run build)
 fi
-# The build MUST be the node-server preset (runnable by apt-native node) — never bun.
-if grep -rq 'Bun\.serve' web/.output/server/index.mjs 2>/dev/null; then
-  echo "ERROR: web/.output contains Bun.serve — wrong nitro preset (need 'node-server')" >&2
+# The build MUST be the bun preset (our Bun.serve TLS entry) — node can't run Bun.serve.
+if ! grep -rq 'Bun\.serve' web/.output/server/index.mjs 2>/dev/null; then
+  echo "ERROR: web/.output has no Bun.serve — wrong nitro preset (need 'bun' + the custom entry)" >&2
   exit 1
 fi
 
@@ -30,6 +41,24 @@ STAGE="$(mktemp -d)"
 trap 'rm -rf "$STAGE"' EXIT
 SHAREDIR="$STAGE/usr/share/$PKG"
 DOCDIR="$STAGE/usr/share/doc/$PKG"
+LIBDIR="$STAGE/usr/lib/$PKG"
+
+# --- vendor the bun runtime --------------------------------------------------
+# Honor a pre-fetched bun (CI may cache it) via BUN_BIN; else download the pinned release.
+mkdir -p "$LIBDIR"
+if [ -n "${BUN_BIN:-}" ]; then
+  echo "==> vendoring bun from BUN_BIN=$BUN_BIN"
+  install -m0755 "$BUN_BIN" "$LIBDIR/bun"
+else
+  url="https://github.com/oven-sh/bun/releases/download/bun-v${BUN_VERSION}/bun-linux-${BUN_ARCH}.zip"
+  echo "==> downloading bun $BUN_VERSION ($BUN_ARCH) from $url"
+  tmp="$(mktemp -d)"
+  curl -fsSL "$url" -o "$tmp/bun.zip"
+  unzip -q "$tmp/bun.zip" -d "$tmp"
+  install -m0755 "$tmp/bun-linux-${BUN_ARCH}/bun" "$LIBDIR/bun"
+  rm -rf "$tmp"
+fi
+"$LIBDIR/bun" --version
 
 # --- file layout -------------------------------------------------------------
 mkdir -p "$SHAREDIR/.output"
@@ -39,7 +68,9 @@ cp -r web/.output/public "$SHAREDIR/.output/public"
 install -d "$STAGE/usr/bin"
 cat > "$STAGE/usr/bin/punktfunk-web-server" <<'WRAP'
 #!/bin/sh
-exec /usr/bin/node /usr/share/punktfunk-web/.output/server/index.mjs "$@"
+# The console runs on the vendored bun (Bun.serve TLS); bun lives privately under
+# /usr/lib/punktfunk-web so it never collides with a system-wide bun on PATH.
+exec /usr/lib/punktfunk-web/bun /usr/share/punktfunk-web/.output/server/index.mjs "$@"
 WRAP
 chmod 0755 "$STAGE/usr/bin/punktfunk-web-server"
 install -Dm0644 scripts/punktfunk-web.service      "$STAGE/usr/lib/systemd/user/punktfunk-web.service"
@@ -71,18 +102,19 @@ install -d "$STAGE/DEBIAN"
 cat > "$STAGE/DEBIAN/control" <<EOF
 Package: $PKG
 Version: $VERSION
-Architecture: all
+Architecture: $DEB_ARCH
 Maintainer: unom <noreply@anthropic.com>
 Installed-Size: $INSTALLED_KB
 Section: net
 Priority: optional
 Homepage: https://git.unom.io/unom/punktfunk
-Depends: nodejs (>= 20)
-Description: punktfunk management web console (Nitro/Node SSR + React)
+Description: punktfunk management web console (Nitro SSR on bun + React)
  The browser console for a punktfunk streaming host: status, paired devices, and the
  SPAKE2 PIN pairing flow every client needs. Runs as a systemd --user service on port
- 3000, login-gated (a password generated on first start), proxying the host's loopback
- HTTPS management API with a bearer token injected server-side (never sent to the browser).
+ 3000 over HTTPS (HTTP/1.1 over TLS, with the host's own identity cert), login-gated (a
+ password generated on first start), proxying the host's loopback HTTPS management API
+ with a bearer token injected server-side (never sent to the browser). Bundles its own
+ bun runtime (no system nodejs/bun dependency).
  .
  Auto-wired to the host on a packaged install: it sources the host's
  ~/.config/punktfunk/mgmt-token and a generated login password — no env editing. Enable
@@ -98,14 +130,14 @@ if [ "$1" = "configure" ]; then
     echo "A login password is generated on first start — read it with:"
     echo "    journalctl --user -u punktfunk-web-init | sed -n 's/.*password generated: //p'"
     echo "    (or: sed -n 's/^PUNKTFUNK_UI_PASSWORD=//p' ~/.config/punktfunk/web-password)"
-    echo "Then open http://<host-ip>:3000"
+    echo "Then open https://<host-ip>:3000 (self-signed host cert — trust it once)"
 fi
 exit 0
 EOF
 chmod 0755 "$STAGE/DEBIAN/postinst"
 
 mkdir -p dist
-OUT="dist/${PKG}_${VERSION}_all.deb"
+OUT="dist/${PKG}_${VERSION}_${DEB_ARCH}.deb"
 dpkg-deb --root-owner-group --build "$STAGE" "$OUT" >/dev/null
 echo "built $OUT"
 dpkg-deb -I "$OUT" | sed -n 's/^/  /p' | grep -E 'Version|Installed-Size|Depends' || true