refactor(host/W6.1): extract secret/config-dir helpers into the pf-paths leaf crate

Second de-coupling for the host crate carve (plan §W6.1 leaf). config_dir /
create_private_dir / write_secret_file (+ the Windows DACL helpers) were pub(crate) in the
gamestream junk drawer, yet consumed by vdisplay, stats, gpu, library, mgmt_token,
native_pairing and the Windows service — many of which become pf-media / pf-vdisplay, for
which crate::gamestream would be an illegal upward edge. New leaf crate pf-paths (pure std
+ tracing) owns them; ~40 call sites across 14 files repoint to pf_paths::. gamestream
keeps only its own concerns.

Verified: Linux (home-worker-5) clippy -p pf-paths -p punktfunk-host --all-targets
-D warnings + tests (347 pass, incl. secrets_are_written_owner_only); Windows
(192.168.1.158) clippy --features nvenc,amf-qsv --all-targets green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/punktfunk-host/src/vdisplay/identity.rs

@@ -76,7 +76,7 @@ impl DisplayIdentityMap {
     /// re-derives ids, costing a client one scaling re-set the first time). Migrates the legacy
     /// Windows `pf-vdisplay-identity.json` if the new file is absent.
     pub(crate) fn load() -> Self {
-        let dir = crate::gamestream::config_dir();
+        let dir = pf_paths::config_dir();
         let path = dir.join(FILE);
         let bytes = std::fs::read(&path)
             .or_else(|_| std::fs::read(dir.join(LEGACY_FILE)))
@@ -240,7 +240,7 @@ impl ScaleMap {
     /// Load the persisted map (empty on first run / unreadable file — a client just re-sets its
     /// scaling once). Drops non-finite / out-of-range entries from a hand-edited file.
     fn load() -> Self {
-        let path = crate::gamestream::config_dir().join(SCALE_FILE);
+        let path = pf_paths::config_dir().join(SCALE_FILE);
         let mut map: std::collections::BTreeMap<String, f64> = std::fs::read(&path)
             .ok()
             .and_then(|b| serde_json::from_slice(&b).ok())