refactor(host/W6.1): extract secret/config-dir helpers into the pf-paths leaf crate

Second de-coupling for the host crate carve (plan §W6.1 leaf). config_dir /
create_private_dir / write_secret_file (+ the Windows DACL helpers) were pub(crate) in the
gamestream junk drawer, yet consumed by vdisplay, stats, gpu, library, mgmt_token,
native_pairing and the Windows service — many of which become pf-media / pf-vdisplay, for
which crate::gamestream would be an illegal upward edge. New leaf crate pf-paths (pure std
+ tracing) owns them; ~40 call sites across 14 files repoint to pf_paths::. gamestream
keeps only its own concerns.

Verified: Linux (home-worker-5) clippy -p pf-paths -p punktfunk-host --all-targets
-D warnings + tests (347 pass, incl. secrets_are_written_owner_only); Windows
(192.168.1.158) clippy --features nvenc,amf-qsv --all-targets green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/punktfunk-host/src/gamestream/cert.rs

@@ -2,8 +2,8 @@
 //! during pairing AND presented as the TLS server cert on 47984 (Moonlight pins it). The
 //! cert's own X.509 signature bytes are an input to the pairing hashes, so we extract them.
 
-use super::config_dir;
 use anyhow::{anyhow, Context, Result};
+use pf_paths::config_dir;
 use rsa::pkcs1v15::SigningKey;
 use rsa::pkcs8::DecodePrivateKey;
 use rsa::RsaPrivateKey;
@@ -36,11 +36,11 @@ impl ServerIdentity {
                 // The private key is the trust root for EVERY surface (TLS server cert, pairing
                 // signing, the QUIC identity clients pin) — write it owner-only (0600 / SYSTEM-only
                 // DACL) so a local user can't read it and impersonate the host. The dir is 0700.
-                super::create_private_dir(&dir).ok();
-                super::write_secret_file(&key_path, k.as_bytes())
+                pf_paths::create_private_dir(&dir).ok();
+                pf_paths::write_secret_file(&key_path, k.as_bytes())
                     .with_context(|| format!("write {}", key_path.display()))?;
                 // The cert is public (handed to clients), but write it owner-only too for consistency.
-                super::write_secret_file(&cert_path, c.as_bytes())
+                pf_paths::write_secret_file(&cert_path, c.as_bytes())
                     .with_context(|| format!("write {}", cert_path.display()))?;
                 tracing::info!(path = %cert_path.display(), "generated punktfunk host certificate (RSA-2048, key 0600)");
                 (c, k)