fix(packaging): correct CachyOS firewall to ufw + ship ufw openers + web-console opener

CachyOS ships ufw enabled by default (firewalld is not installed) — verified live
on the .21 box — but the docs and shipped firewall openers claimed "CachyOS enables
firewalld by default". Correct that everywhere and ship a ufw application profile
(the one-liner analogue of the firewalld service files):

- packaging/linux/punktfunk.ufw (new): [punktfunk-native], [punktfunk-gamestream],
  [punktfunk-web] profiles, installed to /etc/ufw/applications.d/punktfunk by the
  Arch (CachyOS) and .deb host packages. `sudo ufw allow punktfunk-native`.
- packaging/linux/punktfunk-web.xml (new): firewalld service for the optional web
  console (TCP 47992), installed by the host package on arch/deb/rpm. Neither the
  native nor gamestream opener covered 47992, so a firewalld/ufw host that enabled
  punktfunk-web could not reach the console over the LAN.
- Fix the "CachyOS enables firewalld" claim in arch.md, arch/README.md,
  debian/README.md, both firewalld service .xml comments, and the pacman scriptlet;
  firewalld now attributed to the spins that use it (EndeavourOS, Fedora/RHEL).
- Docs present both one-liners (ufw + firewalld) whichever firewall you run, plus a
  console-opener step; postinst/scriptlet hints detect ufw as well as firewalld.

The native data plane stays hole-punched (ephemeral UDP, no fixed port) — its
openers correctly open only 9777/udp + mDNS; the stale "open a UDP range" note is
replaced with the accurate outbound-UDP explanation.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packaging/arch/PKGBUILD

@@ -134,14 +134,22 @@ package_punktfunk-host() {
   install -Dm0644 "$R/packaging/bazzite/gamescope-headless-session" \
     "$pkgdir/etc/gamescope-session-plus/sessions.d/steam"
   install -Dm0644 "$R/api/openapi.json"                 "$pkgdir/usr/share/punktfunk/openapi.json"
-  # firewalld service definitions — NOT auto-enabled (Arch packages never touch the admin's
-  # firewall). Stock Arch ships none, so they're a no-op there; CachyOS et al. ship firewalld, so
-  #   sudo firewall-cmd --reload && sudo firewall-cmd --permanent --add-service=punktfunk-gamestream && sudo firewall-cmd --reload
-  # (or =punktfunk-native). See README.md → Firewall.
+  # Firewall openers — NOT auto-enabled (an Arch package never touches the admin's running firewall).
+  # Stock Arch ships no firewall; CachyOS ships ufw; some spins (EndeavourOS) enable firewalld — so we
+  # install BOTH a ufw application profile and firewalld service definitions, and the one for whatever
+  # firewall you actually run is a one-liner. See README.md → Firewall.
+  #   ufw:       sudo ufw allow punktfunk-native            (or punktfunk-gamestream)
+  #   firewalld: sudo firewall-cmd --reload && sudo firewall-cmd --permanent --add-service=punktfunk-native && sudo firewall-cmd --reload
+  install -Dm0644 "$R/packaging/linux/punktfunk.ufw" \
+    "$pkgdir/etc/ufw/applications.d/punktfunk"
   install -Dm0644 "$R/packaging/linux/punktfunk-gamestream.xml" \
     "$pkgdir/usr/lib/firewalld/services/punktfunk-gamestream.xml"
   install -Dm0644 "$R/packaging/linux/punktfunk-native.xml" \
     "$pkgdir/usr/lib/firewalld/services/punktfunk-native.xml"
+  # Web console opener (TCP 47992) — only meaningful with the optional punktfunk-web package; opened
+  # deliberately (see README.md → Firewall). ufw's equivalent is the punktfunk-web profile above.
+  install -Dm0644 "$R/packaging/linux/punktfunk-web.xml" \
+    "$pkgdir/usr/lib/firewalld/services/punktfunk-web.xml"
   install -Dm0644 "$R/LICENSE-MIT"    "$pkgdir/usr/share/licenses/punktfunk-host/LICENSE-MIT"
   install -Dm0644 "$R/LICENSE-APACHE" "$pkgdir/usr/share/licenses/punktfunk-host/LICENSE-APACHE"
   install -Dm0644 "$R/README.md"      "$pkgdir/usr/share/doc/punktfunk-host/README.md"