fix(packaging): correct CachyOS firewall to ufw + ship ufw openers + web-console opener

CachyOS ships ufw enabled by default (firewalld is not installed) — verified live
on the .21 box — but the docs and shipped firewall openers claimed "CachyOS enables
firewalld by default". Correct that everywhere and ship a ufw application profile
(the one-liner analogue of the firewalld service files):

- packaging/linux/punktfunk.ufw (new): [punktfunk-native], [punktfunk-gamestream],
  [punktfunk-web] profiles, installed to /etc/ufw/applications.d/punktfunk by the
  Arch (CachyOS) and .deb host packages. `sudo ufw allow punktfunk-native`.
- packaging/linux/punktfunk-web.xml (new): firewalld service for the optional web
  console (TCP 47992), installed by the host package on arch/deb/rpm. Neither the
  native nor gamestream opener covered 47992, so a firewalld/ufw host that enabled
  punktfunk-web could not reach the console over the LAN.
- Fix the "CachyOS enables firewalld" claim in arch.md, arch/README.md,
  debian/README.md, both firewalld service .xml comments, and the pacman scriptlet;
  firewalld now attributed to the spins that use it (EndeavourOS, Fedora/RHEL).
- Docs present both one-liners (ufw + firewalld) whichever firewall you run, plus a
  console-opener step; postinst/scriptlet hints detect ufw as well as firewalld.

The native data plane stays hole-punched (ephemeral UDP, no fixed port) — its
openers correctly open only 9777/udp + mDNS; the stale "open a UDP range" note is
replaced with the accurate outbound-UDP explanation.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packaging/arch/punktfunk-host.install

@@ -17,15 +17,24 @@ punktfunk-host installed.
 NOTE: encode is NVENC-only. Install 'nvidia-utils' on an NVIDIA host. An AMD Steam Deck is NOT
       yet supported — it needs a VAAPI (hevc_vaapi) encoder backend (see packaging/arch/README.md).
 MSG
-  # Firewall: stock Arch ships none (ports already open), but CachyOS et al. enable firewalld. We
-  # install firewalld service definitions but never touch the running firewall — just point the way.
+  # Firewall: stock Arch ships none (ports already open); CachyOS ships ufw; some spins (EndeavourOS)
+  # enable firewalld. We install a ufw app profile AND firewalld service definitions but never touch
+  # the running firewall — just point the way for whichever is active.
+  if command -v ufw >/dev/null 2>&1; then
+    cat <<'MSG'
+
+  4. ufw is installed — open the streaming ports once (native-only host shown; add
+     'punktfunk-gamestream' as well for Moonlight compat):
+       sudo ufw allow punktfunk-native
+MSG
+  fi
   if command -v firewall-cmd >/dev/null 2>&1; then
     cat <<'MSG'
 
-  4. firewalld is active — open the streaming ports once (GameStream/Moonlight shown; use
-     'punktfunk-native' instead for the native-only host):
-       sudo firewall-cmd --reload                                        # load the new service def
-       sudo firewall-cmd --permanent --add-service=punktfunk-gamestream
+  4. firewalld is active — open the streaming ports once (native-only host shown; add
+     'punktfunk-gamestream' as well for Moonlight compat):
+       sudo firewall-cmd --reload                                     # load the new service def
+       sudo firewall-cmd --permanent --add-service=punktfunk-native
        sudo firewall-cmd --reload
 MSG
   fi