fix(web): bundle deps into the server (noExternals) — kill the 47k-file install

The Windows installer ballooned to 154 MB and installed forever because the node-server
bundle externalized the WHOLE @unom/ui dependency tree (payload, lexical, date-fns,
prismjs…) to .output/server/node_modules — 47,567 files / 730 MB copied into Program
Files. Set Nitro `noExternals: true` so every dependency is bundled + tree-shaken into the
server output: .output drops to ~75 files / 10 MB, and the bare external imports
(srvx, seroval…) bun couldn't resolve at runtime are gone — so the console runs on bun
(no node, no node_modules), which is the issue we previously worked around with node.

Windows installer now ships bun.exe + the ~75-file .output (was node.exe + a node_modules
forest) and runs `bun .output\server\index.mjs`:
- windows-host.yml: fetch a pinned portable bun (build tool AND shipped runtime); drop the
  node fetch + the .output/server install; smoke-boot under the bundled bun.
- pack-host-installer.ps1 / punktfunk-host.iss: -NodeExe -> -BunExe; stage {app}\bun\bun.exe.
- web-run.cmd / build-web.ps1: run/restart on bun; docs updated.

Net win everywhere: the Linux .deb shrinks (node still runs the self-contained output), and
the docker web image — which already ran `bun run .output/server/index.mjs` with only
.output copied — is fixed (the externals had no node_modules to resolve at runtime).

Validated locally: noExternals build = 75 files / 10 MB; node AND bun both serve /login
(200) + static assets (200) + gate /api (401).

(A true single binary via `bun build --compile` is blocked for now: Nitro serves public
assets from an import.meta-relative path `--compile` doesn't embed (/$bunfs/public); the
75-file payload is the clean result.)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packaging/windows/pack-host-installer.ps1

@@ -27,7 +27,7 @@ param(
     [string]$PfxPassword = $env:MSIX_CERT_PASSWORD,
     [string]$FfmpegDir = $env:FFMPEG_DIR,                           # bundle its bin\*.dll (amf-qsv build)
     [string]$WebDir = $env:WEB_OUTPUT_DIR,                          # built web .output tree -> bundle the mgmt console
-    [string]$NodeExe = $env:NODE_EXE,                              # portable node.exe (>= 20) runtime for the console
+    [string]$BunExe = $env:BUN_EXE,                                # portable bun.exe runtime for the console
     [switch]$NoDriver,                                              # build without the bundled SudoVDA driver
     [switch]$NoSign                                                 # skip signing (local debug)
 )
@@ -184,30 +184,30 @@ if ($ffmpegBinSrc -and (Test-Path $ffmpegBinSrc)) {
 }
 else { Write-Host "no FFMPEG_DIR\bin -> installer built WITHOUT FFmpeg DLLs (nvenc/software-only host)" }
 
-# --- stage the web management console (the built .output tree + a portable node + the launcher) ---
-# The console runs as the PunktfunkWeb scheduled task (`node {app}\web\.output\server\index.mjs`),
+# --- stage the web management console (the self-contained .output tree + a portable bun + launcher) -
+# The console runs as the PunktfunkWeb scheduled task (`bun {app}\web\.output\server\index.mjs`),
 # auto-wired to the host's loopback mgmt API. Stage everything ISCC reads into $OutDir (the
-# non-WOW64-redirected C:\t area, same reason as the .iss/host.env staging above). Built upstream
-# (windows-host.yml mirrors deb.yml: bun build -> node-server preset + the .output/server deps);
-# omitted when -WebDir/-NodeExe are unset (host-only installer, e.g. a local debug pack).
-if ($WebDir -and (Test-Path $WebDir) -and $NodeExe -and (Test-Path $NodeExe)) {
+# non-WOW64-redirected C:\t area, same reason as the .iss/host.env staging above). The .output is
+# self-contained (Nitro noExternals — deps bundled + tree-shaken, no node_modules), so bun runs it
+# directly; omitted when -WebDir/-BunExe are unset (host-only installer, e.g. a local debug pack).
+if ($WebDir -and (Test-Path $WebDir) -and $BunExe -and (Test-Path $BunExe)) {
     $webStage = Join-Path $OutDir 'web'
     if (Test-Path $webStage) { Remove-Item $webStage -Recurse -Force }
     New-Item -ItemType Directory -Force -Path $webStage | Out-Null
     Copy-Item (Join-Path $WebDir '*') -Destination $webStage -Recurse -Force
-    $nodeStage = Join-Path $OutDir 'node.exe'
-    Copy-Item -LiteralPath $NodeExe -Destination $nodeStage -Force
+    $bunStage = Join-Path $OutDir 'bun.exe'
+    Copy-Item -LiteralPath $BunExe -Destination $bunStage -Force
     $webRun = Join-Path $OutDir 'web-run.cmd'
     $webSetup = Join-Path $OutDir 'web-setup.ps1'
     Copy-Item (Join-Path $repoRoot 'scripts\windows\web-run.cmd') -Destination $webRun -Force
     Copy-Item (Join-Path $repoRoot 'scripts\windows\web-setup.ps1') -Destination $webSetup -Force
     $defines += "/DWebDir=$webStage"
-    $defines += "/DNodeExe=$nodeStage"
+    $defines += "/DBunExe=$bunStage"
     $defines += "/DWebRunCmd=$webRun"
     $defines += "/DWebSetup=$webSetup"
-    Write-Host "bundling the web console from $WebDir (+ node $NodeExe)"
+    Write-Host "bundling the web console from $WebDir (+ bun $BunExe)"
 }
-else { Write-Host "no -WebDir/-NodeExe -> installer built WITHOUT the web console" }
+else { Write-Host "no -WebDir/-BunExe -> installer built WITHOUT the web console" }
 
 # --- build the installer (from the non-redirected copy under C:\t) -----------------------------
 Write-Host "==> ISCC $($defines -join ' ') $issLocal"