feat(web): harden login gate — throttle, scoped TLS, token-derived seal key

Remediates the two web-console residuals from the 2026-07-05 posture audit:

- Brute-force throttle (loginThrottle.ts): per-IP exponential backoff
  after 5 free attempts, plus a global floor for spread-out floods, keyed
  on the socket peer IP (not spoofable X-Forwarded-For) with a size-capped
  map. The constant-time compare already stopped the timing leak; this
  bounds guess *volume* against a by-design LAN-exposed console.
- Session seal key now derives from the high-entropy mgmt token instead of
  the low-entropy login password, so a captured cookie is no longer an
  offline password oracle. Falls back to the password only when no token
  is configured (dev/local). Rotating the token now invalidates sessions.
- Replace the process-wide NODE_TLS_REJECT_UNAUTHORIZED=0 with per-request
  Bun TLS scoped to the loopback proxy hop; a non-loopback mgmt URL now
  verifies normally. Dropped the env var from the systemd unit, Steam Deck
  installer, Windows run scripts, env examples, and web README.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

web/server/routes/api/[...].ts

@@ -9,11 +9,12 @@ import {
 	proxyRequest,
 	setResponseStatus,
 } from "h3";
-import { mgmtToken, mgmtUrl } from "../../util/auth";
+import { isLoopbackUrl, mgmtToken, mgmtUrl } from "../../util/auth";
 
 export default defineEventHandler((event) => {
 	const { pathname, search } = getRequestURL(event);
-	const target = `${mgmtUrl()}${pathname}${search}`;
+	const base = mgmtUrl();
+	const target = `${base}${pathname}${search}`;
 	const token = mgmtToken();
 	// The mgmt API now requires a token always. Without one configured, forwarding an empty bearer
 	// would just bounce as 401 — fail fast and legibly instead (the packaged service sources the
@@ -25,7 +26,20 @@ export default defineEventHandler((event) => {
 				"management token not configured (PUNKTFUNK_MGMT_TOKEN / ~/.config/punktfunk/mgmt-token)",
 		};
 	}
+	// TLS scoping (replaces the old process-wide NODE_TLS_REJECT_UNAUTHORIZED=0): the host presents a
+	// SELF-SIGNED, no-SAN identity cert on loopback, which normal verification rejects. We relax
+	// verification ONLY for this one loopback hop, via Bun's per-request `tls` option — so any OTHER
+	// outbound TLS the process ever makes still verifies normally (the global env unverified
+	// everything). If the operator points PUNKTFUNK_MGMT_URL at a NON-loopback host, we do NOT relax:
+	// a remote mgmt API must present a valid chain, which is stricter than the old blanket accept.
+	const fetchOptions = isLoopbackUrl(base)
+		? // `tls` is a Bun.fetch extension (the console runs on bun — Bun.serve/`bun .output/...`), not
+			// in the standard RequestInit type, so cast through unknown.
+			({ tls: { rejectUnauthorized: false } } as unknown as RequestInit)
+		: undefined;
+
 	return proxyRequest(event, target, {
+		fetchOptions,
 		headers: {
 			// Overwrite, not append: the host-held token replaces anything the browser sent.
 			authorization: `Bearer ${token}`,