feat(web): consolidate paired devices, self-contained sections, docs + lint

Web console
- Pairing/Library/Stats refactored into self-contained subsections that each own
  their own queries + mutations; a shared slot-based layout (view.tsx) is filled by
  the live page (containers) and Storybook (pure cards + fixtures) so the layout can't
  drift.
- All paired devices in one list on Pairing with a protocol column (punktfunk/1 +
  Moonlight), routing each unpair to the right endpoint; the redundant Clients page is
  removed.
- Library: overview grid split from the add/edit form into separate files.
- Login screen links out to the docs.

Docs
- "Console login password" section on every host page (apt/RPM/Bazzite/SteamOS/Windows)
  plus a new "Forgot your Password?" troubleshooting page, linked from the login screen.
- Console served as HTTP/1.1 over TLS (drop the unusable HTTP/3 advertising) across the
  Bun entry, launchers, systemd units, and packaging.

Tooling
- Biome now respects .gitignore (stops linting generated code), config migrated to
  2.5.1; all lint issues fixed cleanly.

Also includes this branch's in-progress host, Apple client, packaging, and CI changes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/windows/web-run.cmd

@@ -4,21 +4,29 @@ rem
 rem Lays out next to the installed payload: {app}\web\web-run.cmd, {app}\web\.output\... and
 rem {app}\bun\bun.exe (so %~dp0 = {app}\web\). Auto-wires the console the same way the Linux
 rem systemd unit does: it sources the host's mgmt bearer token + the console login password from
-rem %ProgramData%\punktfunk\, points the /api proxy at the host's loopback HTTPS mgmt API, and runs
-rem the (self-contained, no-node_modules) Nitro server on :3000 with the bundled bun. No env editing.
+rem %ProgramData%\punktfunk\, points the /api proxy at the host's loopback HTTPS mgmt API, and serves
+rem the (self-contained, no-node_modules) Nitro console over HTTPS (HTTP/1.1 over TLS) on :3000 with the
+rem bundled bun, using the host's OWN identity cert. No env editing.
 setlocal EnableExtensions
 
 set "PFDATA=%ProgramData%\punktfunk"
 set "TOKENFILE=%PFDATA%\mgmt-token"
 set "PWFILE=%PFDATA%\web-password"
+set "CERTFILE=%PFDATA%\cert.pem"
+set "KEYFILE=%PFDATA%\key.pem"
 
-rem The host's `serve` writes the mgmt token on first run. Until it exists the proxy has no
-rem credential, so fail and let the task's restart-on-failure retry (mirrors the Linux unit's
-rem Restart=on-failure waiting for the host to create it).
+rem The host's `serve` writes the mgmt token + its identity cert/key on first run. Until they exist
+rem we have no credential and no TLS material, so fail and let the task's restart-on-failure retry
+rem (mirrors the Linux unit's Restart=on-failure waiting for the host to create them) rather than
+rem silently downgrading to plain HTTP.
 if not exist "%TOKENFILE%" (
   echo [punktfunk-web] mgmt token not present yet at "%TOKENFILE%" - waiting for the host service.
   exit /b 1
 )
+if not exist "%CERTFILE%" (
+  echo [punktfunk-web] host identity cert not present yet at "%CERTFILE%" - waiting for the host service.
+  exit /b 1
+)
 
 rem Both files are single KEY=VALUE lines (LF), written 0600/ACL'd: PUNKTFUNK_MGMT_TOKEN=... and
 rem PUNKTFUNK_UI_PASSWORD=... . Split on the first '=' and import each into the environment.
@@ -30,6 +38,10 @@ set "PORT=3000"
 set "HOST=0.0.0.0"
 set "PUNKTFUNK_MGMT_URL=https://127.0.0.1:47990"
 set "NODE_TLS_REJECT_UNAUTHORIZED=0"
+rem Serve HTTPS (HTTP/1.1 over TLS) with the host's identity cert; mark the session cookie Secure.
+set "PUNKTFUNK_UI_TLS_CERT=%CERTFILE%"
+set "PUNKTFUNK_UI_TLS_KEY=%KEYFILE%"
+set "PUNKTFUNK_UI_SECURE=1"
 
 set "BUN=%~dp0..\bun\bun.exe"
 set "SERVER=%~dp0.output\server\index.mjs"