rename: lumen → punktfunk, everywhere

Full project rename, decided 2026-06-10:
- Crates/binaries: punktfunk-core / punktfunk-host / punktfunk-client-rs.
- C ABI: punktfunk_* symbols, Punktfunk* types, include/punktfunk_core.h,
  PUNKTFUNK_FEATURE_QUIC guard (header regenerated; cbindgen renames updated, incl.
  PUNKTFUNK_BTN_*/PUNKTFUNK_AXIS_* wire constants).
- Protocol: punktfunk/1 — control-plane magic LMN1 → PKF1, nonce salt lmn1 → pkf1.
  WIRE BREAK: clients must be rebuilt from this revision.
- Env knobs: PUNKTFUNK_VIDEO_SOURCE / PUNKTFUNK_COMPOSITOR / PUNKTFUNK_ZEROCOPY / ….
- Host config dir: ~/.config/punktfunk (the box's dir was migrated in place — the
  persistent identity is unchanged, pinned fingerprints stay valid).
- Swift package: PunktfunkKit + PunktfunkCore.xcframework + PunktfunkConnection
  (Sources/PunktfunkClient app + tests renamed with it); build-xcframework.sh updated.
- scripts/: 60-punktfunk.rules, punktfunk-host.service; OpenAPI doc regenerated.

Also: scripts/headless/run-headless-kde.sh — full headless Plasma bringup. Root cause of
"desktop but no apps/settings" over the stream: plasmashell launched without
XDG_MENU_PREFIX=plasma-, so the launcher resolved a nonexistent applications.menu and
rendered an empty menu. The script sets the complete KDE session env (menu prefix,
KDE_FULL_SESSION, session version) and rebuilds ksycoca before starting plasmashell.

Gate: 97/97 tests, clippy -D warnings (both feature sets), fmt, C-ABI harness PASS,
zero lumen references left outside .git.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/punktfunk-host/src/gamestream/serverinfo.rs

@@ -0,0 +1,42 @@
+//! The `/serverinfo` capability/status XML Moonlight GETs before pairing and each launch.
+
+use super::{Host, APP_VERSION, GFE_VERSION, SERVER_CODEC_MODE_SUPPORT};
+
+/// Build the `<root status_code="200">…</root>` serverinfo document. `https` selects the
+/// paired-HTTPS variant (real MAC). Element names are case-sensitive and match what
+/// moonlight-common-c parses.
+pub fn serverinfo_xml(host: &Host, https: bool) -> String {
+    // MAC is hidden over plain HTTP; PairStatus reflects the pairing store once the HTTPS
+    // path carries per-client identity (a hardening follow-up — 0 for now).
+    let mac = if https {
+        "01:02:03:04:05:06"
+    } else {
+        "00:00:00:00:00:00"
+    };
+    // Over the mutual-TLS HTTPS port the peer is an authenticated (paired) client.
+    let pair_status = u8::from(https);
+    format!(
+        r#"<?xml version="1.0" encoding="utf-8"?>
+<root status_code="200">
+<hostname>{hostname}</hostname>
+<appversion>{APP_VERSION}</appversion>
+<GfeVersion>{GFE_VERSION}</GfeVersion>
+<uniqueid>{uniqueid}</uniqueid>
+<HttpsPort>{https_port}</HttpsPort>
+<ExternalPort>{http_port}</ExternalPort>
+<MaxLumaPixelsHEVC>1869449984</MaxLumaPixelsHEVC>
+<mac>{mac}</mac>
+<LocalIP>{local_ip}</LocalIP>
+<ServerCodecModeSupport>{SERVER_CODEC_MODE_SUPPORT}</ServerCodecModeSupport>
+<PairStatus>{pair_status}</PairStatus>
+<currentgame>0</currentgame>
+<state>SUNSHINE_SERVER_FREE</state>
+</root>
+"#,
+        hostname = host.hostname,
+        uniqueid = host.uniqueid,
+        https_port = host.https_port,
+        http_port = host.http_port,
+        local_ip = host.local_ip,
+    )
+}