fix: M2 — harden the management API after adversarial review

Five confirmed findings from a 46-agent review panel:
- Empty --mgmt-token no longer satisfies the non-loopback token gate
  (critical: 'Bearer ' with an empty token authenticated; parse_serve now
  bails on blank tokens and mgmt::run treats blank as none)
- axum's built-in body rejections (400/415/422) now wear the documented
  ApiError envelope via an ApiJson extractor, and the spec documents them
- GET /health carries security([{}]) in the spec, matching the server's
  auth exemption
- unpairClient's description no longer claims revocation the TLS layer
  doesn't enforce yet (gamestream/tls.rs accepts any cert — known gap)
- CLAUDE.md/README.md no longer reference the deleted web.rs

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -16,9 +16,11 @@ Low-latency desktop streaming stack, Linux-first, with a shared Rust protocol co
   round-trips every access unit through a `lumen_core` host→client session (0 mismatches).
   See [`docs/linux-setup.md`](docs/linux-setup.md); the code is in
   `crates/lumen-host/src/{m0,capture,encode}.rs` (+ `capture/linux.rs`, `encode/linux.rs`).
-- **The remaining host backends are `#[cfg(target_os = "linux")]` stubs** — KWin/Mutter
-  virtual displays (`vdisplay.rs`), libei/uinput input (`inject.rs`), web/pairing
-  (`web.rs`). They compile everywhere but `bail!` until implemented. This is **M2**.
+- **M2 is in flight.** The GameStream control plane lives in `gamestream/` (mDNS,
+  serverinfo, pairing, RTSP, ENet control, video/audio streams) and the management REST
+  API in `mgmt.rs`; the remaining `#[cfg(target_os = "linux")]` backends — KWin/Mutter
+  virtual displays (`vdisplay.rs`), libei/uinput input (`inject.rs`) — compile everywhere
+  and `bail!` where unimplemented.
 
 ## Build / test / run
 
@@ -83,9 +85,9 @@ tokio runtime) + `pipewire` **0.9** (must match ashpd's; not 0.10) + `ffmpeg-nex
 ## Next: M2 — P1 host to a stock Moonlight client
 
 Wire M0's capture→encode pipeline (`m0.rs` / `pipeline.rs`) into a streaming host: KWin
-virtual output (`vdisplay.rs`, study KRdp), `serverinfo`/pairing/RTSP (`web.rs`) enough for
-a real Moonlight client, input via reis/uinput (`inject.rs`). The module seams exist and
-`bail!` today.
+virtual output (`vdisplay.rs`, study KRdp), `serverinfo`/pairing/RTSP
+(`gamestream/{nvhttp,pairing,rtsp}.rs`) enough for a real Moonlight client, input via
+reis/uinput (`inject.rs`), management/config REST API (`mgmt.rs`).
 
 ## Conventions