rename: lumen → punktfunk, everywhere

Full project rename, decided 2026-06-10:
- Crates/binaries: punktfunk-core / punktfunk-host / punktfunk-client-rs.
- C ABI: punktfunk_* symbols, Punktfunk* types, include/punktfunk_core.h,
  PUNKTFUNK_FEATURE_QUIC guard (header regenerated; cbindgen renames updated, incl.
  PUNKTFUNK_BTN_*/PUNKTFUNK_AXIS_* wire constants).
- Protocol: punktfunk/1 — control-plane magic LMN1 → PKF1, nonce salt lmn1 → pkf1.
  WIRE BREAK: clients must be rebuilt from this revision.
- Env knobs: PUNKTFUNK_VIDEO_SOURCE / PUNKTFUNK_COMPOSITOR / PUNKTFUNK_ZEROCOPY / ….
- Host config dir: ~/.config/punktfunk (the box's dir was migrated in place — the
  persistent identity is unchanged, pinned fingerprints stay valid).
- Swift package: PunktfunkKit + PunktfunkCore.xcframework + PunktfunkConnection
  (Sources/PunktfunkClient app + tests renamed with it); build-xcframework.sh updated.
- scripts/: 60-punktfunk.rules, punktfunk-host.service; OpenAPI doc regenerated.

Also: scripts/headless/run-headless-kde.sh — full headless Plasma bringup. Root cause of
"desktop but no apps/settings" over the stream: plasmashell launched without
XDG_MENU_PREFIX=plasma-, so the launcher resolved a nonexistent applications.menu and
rendered an empty menu. The script sets the complete KDE session env (menu prefix,
KDE_FULL_SESSION, session version) and rebuilds ksycoca before starting plasmashell.

Gate: 97/97 tests, clippy -D warnings (both feature sets), fmt, C-ABI harness PASS,
zero lumen references left outside .git.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/punktfunk-host/src/gamestream/crypto.rs

@@ -0,0 +1,60 @@
+//! Pairing crypto primitives (control plane only — distinct from `punktfunk_core`'s AES-GCM
+//! data-plane sealing). GameStream pairing uses: AES-128-**ECB** with **no padding**,
+//! SHA-256 (host appversion major ≥ 7), and RSA-PKCS1v15-SHA256 signatures. See the
+//! `serverinfo + pairing` section of `docs/research/gamestream-protocol-research.json`.
+
+use aes::cipher::generic_array::GenericArray;
+use aes::cipher::{BlockDecrypt, BlockEncrypt, KeyInit};
+use aes::Aes128;
+use rand::RngCore;
+use sha2::{Digest, Sha256};
+
+/// `n` cryptographically-random bytes.
+pub fn random<const N: usize>() -> [u8; N] {
+    let mut b = [0u8; N];
+    rand::thread_rng().fill_bytes(&mut b);
+    b
+}
+
+/// SHA-256 over the concatenation of `parts`.
+pub fn sha256(parts: &[&[u8]]) -> [u8; 32] {
+    let mut h = Sha256::new();
+    for p in parts {
+        h.update(p);
+    }
+    h.finalize().into()
+}
+
+/// The PIN-derived AES-128 key: `SHA-256(salt || pin)[..16]` (salt first, PIN as ASCII).
+pub fn pin_key(salt: &[u8; 16], pin: &str) -> [u8; 16] {
+    let d = sha256(&[salt, pin.as_bytes()]);
+    let mut k = [0u8; 16];
+    k.copy_from_slice(&d[..16]);
+    k
+}
+
+/// AES-128-ECB encrypt, no padding: input is zero-extended to a 16-byte multiple.
+pub fn ecb_encrypt(key: &[u8; 16], data: &[u8]) -> Vec<u8> {
+    let cipher = Aes128::new(GenericArray::from_slice(key));
+    let mut out = data.to_vec();
+    let rem = out.len() % 16;
+    if rem != 0 {
+        out.resize(out.len() + (16 - rem), 0);
+    }
+    for chunk in out.chunks_mut(16) {
+        cipher.encrypt_block(GenericArray::from_mut_slice(chunk));
+    }
+    out
+}
+
+/// AES-128-ECB decrypt, no padding: trailing bytes past the last whole block are ignored.
+pub fn ecb_decrypt(key: &[u8; 16], data: &[u8]) -> Vec<u8> {
+    let cipher = Aes128::new(GenericArray::from_slice(key));
+    let mut out = Vec::with_capacity(data.len());
+    for chunk in data.chunks_exact(16) {
+        let mut block = *GenericArray::from_slice(chunk);
+        cipher.decrypt_block(&mut block);
+        out.extend_from_slice(&block);
+    }
+    out
+}