fix(packaging): correct CachyOS firewall to ufw + ship ufw openers + web-console opener

CachyOS ships ufw enabled by default (firewalld is not installed) — verified live
on the .21 box — but the docs and shipped firewall openers claimed "CachyOS enables
firewalld by default". Correct that everywhere and ship a ufw application profile
(the one-liner analogue of the firewalld service files):

- packaging/linux/punktfunk.ufw (new): [punktfunk-native], [punktfunk-gamestream],
  [punktfunk-web] profiles, installed to /etc/ufw/applications.d/punktfunk by the
  Arch (CachyOS) and .deb host packages. `sudo ufw allow punktfunk-native`.
- packaging/linux/punktfunk-web.xml (new): firewalld service for the optional web
  console (TCP 47992), installed by the host package on arch/deb/rpm. Neither the
  native nor gamestream opener covered 47992, so a firewalld/ufw host that enabled
  punktfunk-web could not reach the console over the LAN.
- Fix the "CachyOS enables firewalld" claim in arch.md, arch/README.md,
  debian/README.md, both firewalld service .xml comments, and the pacman scriptlet;
  firewalld now attributed to the spins that use it (EndeavourOS, Fedora/RHEL).
- Docs present both one-liners (ufw + firewalld) whichever firewall you run, plus a
  console-opener step; postinst/scriptlet hints detect ufw as well as firewalld.

The native data plane stays hole-punched (ephemeral UDP, no fixed port) — its
openers correctly open only 9777/udp + mDNS; the stale "open a UDP range" note is
replaced with the accurate outbound-UDP explanation.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs-site/content/docs/arch.md

@@ -109,28 +109,40 @@ To set your own, edit that file and `systemctl --user restart punktfunk-web`. Fo
 ## 5. Open the firewall (if you have one)
 
 **Stock Arch ships no firewall** — every port is already open, so you can skip this. But **CachyOS
-enables `firewalld` by default**, and an Arch package never opens ports for you (it won't touch your
-running firewall), so on CachyOS the host is unreachable until you allow it.
+enables `ufw` by default** (firewalld is not installed), and some other spins (e.g. EndeavourOS)
+enable **`firewalld`** — an Arch package never opens ports for you, so on those the host is
+unreachable until you allow it.
 
-The `punktfunk-host` package installs **firewalld service definitions** for exactly this, so
-enabling is one command. Reload once so firewalld sees the just-installed definition, add the
-service, then reload to apply:
+The `punktfunk-host` package installs openers for **both**, so it's a one-liner whichever you run:
 
 ```sh
-sudo firewall-cmd --reload
-sudo firewall-cmd --permanent --add-service=punktfunk-native       # the default native host
-#                              --add-service=punktfunk-gamestream   # …or add this for Moonlight compat
+# ufw — CachyOS (and Ubuntu, once you enable ufw):
+sudo ufw allow punktfunk-native        # the secure native host (the default)
+sudo ufw allow punktfunk-gamestream    # …also this if you run `serve --gamestream` (Moonlight)
+
+# firewalld — Fedora-like spins (EndeavourOS, …):
+sudo firewall-cmd --reload                                    # load the installed definition
+sudo firewall-cmd --permanent --add-service=punktfunk-native
 sudo firewall-cmd --reload
 ```
 
 `punktfunk-native` opens the QUIC control port (UDP 9777) + mDNS discovery; add
 `punktfunk-gamestream` as well if you run `serve --gamestream` (the fixed Moonlight ports + mDNS).
-The media **data plane** uses an *ephemeral* UDP port per session (nothing fixed to open); a
-restrictive firewall must also allow a UDP range. The web console (47992) and mgmt API (47990,
-loopback-only) are **not** opened by these — reach the console from the host box, or open 47992
-yourself if you want it on the LAN. Not on firewalld? See
-[`packaging/arch/README.md`](https://git.unom.io/unom/punktfunk/src/branch/main/packaging/arch/README.md#firewall)
-for the `ufw`/`nftables` port lists.
+The media **data plane** uses an *ephemeral* UDP port that the client opens with a hole-punch — the
+host streams back out through the path the client opened, so there's **nothing fixed to open** as
+long as the firewall allows outbound UDP (the default for both ufw and firewalld).
+
+Enabled the **web console** (`punktfunk-web`, above) and want to reach it from your phone or another
+machine? It's not opened by the streaming rules — open its port too, the same one-liner way:
+
+```sh
+sudo ufw allow punktfunk-web                                                            # ufw
+sudo firewall-cmd --permanent --add-service=punktfunk-web && sudo firewall-cmd --reload  # firewalld
+```
+
+That opens **TCP 47992** (HTTPS, login-gated). The mgmt API (47990) stays loopback-only and is never
+opened. Full port lists (`nftables`, explicit ports) are in
+[`packaging/arch/README.md`](https://git.unom.io/unom/punktfunk/src/branch/main/packaging/arch/README.md#firewall).
 
 ## 6. Connect a client