refactor(host/W6.1): extract secret/config-dir helpers into the pf-paths leaf crate

Second de-coupling for the host crate carve (plan §W6.1 leaf). config_dir /
create_private_dir / write_secret_file (+ the Windows DACL helpers) were pub(crate) in the
gamestream junk drawer, yet consumed by vdisplay, stats, gpu, library, mgmt_token,
native_pairing and the Windows service — many of which become pf-media / pf-vdisplay, for
which crate::gamestream would be an illegal upward edge. New leaf crate pf-paths (pure std
+ tracing) owns them; ~40 call sites across 14 files repoint to pf_paths::. gamestream
keeps only its own concerns.

Verified: Linux (home-worker-5) clippy -p pf-paths -p punktfunk-host --all-targets
-D warnings + tests (347 pass, incl. secrets_are_written_owner_only); Windows
(192.168.1.158) clippy --features nvenc,amf-qsv --all-targets green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/punktfunk-host/src/stats_recorder.rs

@@ -144,7 +144,7 @@ pub struct StatsRecorder {
 /// The default captures directory: `~/.config/punktfunk/captures/` (next to `cert.pem`),
 /// resolved via the same config-dir helper the rest of the host uses.
 pub fn default_dir() -> PathBuf {
-    crate::gamestream::config_dir().join("captures")
+    pf_paths::config_dir().join("captures")
 }
 
 /// `id` charset gate, matching `^[A-Za-z0-9._-]+$` — the exact charset `capture_id` emits (which
@@ -197,7 +197,7 @@ fn civil_from_days(z: i64) -> (i64, u32, u32) {
 impl StatsRecorder {
     /// Create the recorder, creating `dir` (owner-private, best-effort) if missing.
     pub fn new(dir: PathBuf) -> Arc<Self> {
-        if let Err(e) = crate::gamestream::create_private_dir(&dir) {
+        if let Err(e) = pf_paths::create_private_dir(&dir) {
             tracing::warn!(dir = %dir.display(), error = %e, "could not create stats captures dir");
         }
         Arc::new(StatsRecorder {