fix(web): bundle deps into the server (noExternals) — kill the 47k-file install

The Windows installer ballooned to 154 MB and installed forever because the node-server
bundle externalized the WHOLE @unom/ui dependency tree (payload, lexical, date-fns,
prismjs…) to .output/server/node_modules — 47,567 files / 730 MB copied into Program
Files. Set Nitro `noExternals: true` so every dependency is bundled + tree-shaken into the
server output: .output drops to ~75 files / 10 MB, and the bare external imports
(srvx, seroval…) bun couldn't resolve at runtime are gone — so the console runs on bun
(no node, no node_modules), which is the issue we previously worked around with node.

Windows installer now ships bun.exe + the ~75-file .output (was node.exe + a node_modules
forest) and runs `bun .output\server\index.mjs`:
- windows-host.yml: fetch a pinned portable bun (build tool AND shipped runtime); drop the
  node fetch + the .output/server install; smoke-boot under the bundled bun.
- pack-host-installer.ps1 / punktfunk-host.iss: -NodeExe -> -BunExe; stage {app}\bun\bun.exe.
- web-run.cmd / build-web.ps1: run/restart on bun; docs updated.

Net win everywhere: the Linux .deb shrinks (node still runs the self-contained output), and
the docker web image — which already ran `bun run .output/server/index.mjs` with only
.output copied — is fixed (the externals had no node_modules to resolve at runtime).

Validated locally: noExternals build = 75 files / 10 MB; node AND bun both serve /login
(200) + static assets (200) + gate /api (401).

(A true single binary via `bun build --compile` is blocked for now: Nitro serves public
assets from an import.meta-relative path `--compile` doesn't embed (/$bunfs/public); the
75-file payload is the clean result.)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/windows/README.md

@@ -35,10 +35,10 @@ won't start. The service is down only for the build duration.
 ## Web management console
 
 On an **installed** host (the `setup.exe`) the console is set up automatically — no manual steps.
-The installer bundles the built `.output` server + a portable Node and runs
-`scripts\windows\web-setup.ps1`, which registers the **`PunktfunkWeb`** scheduled task (at boot, as
-SYSTEM, restart-on-failure) running `{app}\web\web-run.cmd` → `node …\.output\server\index.mjs` on
-`:3000`, opens inbound TCP 3000, and writes the login password to
+The installer bundles the built (self-contained, no-`node_modules`) `.output` server + a portable
+bun and runs `scripts\windows\web-setup.ps1`, which registers the **`PunktfunkWeb`** scheduled task
+(at boot, as SYSTEM, restart-on-failure) running `{app}\web\web-run.cmd` →
+`bun …\.output\server\index.mjs` on `:3000`, opens inbound TCP 3000, and writes the login password to
 `%ProgramData%\punktfunk\web-password` (ACL'd to Administrators + SYSTEM). The mgmt bearer token it
 proxies with is the host's own `%ProgramData%\punktfunk\mgmt-token`. Browse `http://<host-ip>:3000`
 and log in with the password the installer shows on its final page. To change it, edit

scripts/windows/build-web.ps1

@@ -3,9 +3,9 @@
 
     powershell -ExecutionPolicy Bypass -File scripts\windows\build-web.ps1
 
-  bun = build tool, node = runtime (the Nitro bundle externalizes srvx/@unom for SSR, which
-  bun fails to resolve at runtime). The PunktfunkWeb scheduled task runs web\web-run.cmd ->
-  node .output\server\index.mjs on :3000.
+  bun is both the build tool AND the runtime: vite.config's Nitro noExternals bundles every dep
+  into the self-contained .output (no node_modules, nothing for bun to fail to resolve), so the
+  PunktfunkWeb task runs web\web-run.cmd -> bun .output\server\index.mjs on :3000.
 #>
 $ErrorActionPreference = 'Stop'
 $repo = Split-Path (Split-Path $PSScriptRoot)
@@ -19,17 +19,11 @@ Write-Host "bun install + build ..."
 & $bun install
 & $bun run build
 if ($LASTEXITCODE -ne 0) { throw "web build failed (exit $LASTEXITCODE)" }
-
-# The Nitro server bundle externalizes its runtime deps - install them in .output/server,
-# with the @unom registry .npmrc present (else @unom/* 404s on npmjs).
-Write-Host "installing externalized server deps ..."
-Copy-Item "$web\.npmrc" "$web\.output\server\.npmrc" -Force
-Set-Location "$web\.output\server"
-& $bun install
+# No .output/server install: noExternals means the output has no externalized deps to resolve.
 
 Write-Host "restarting $task ..."
 & schtasks /end /tn $task 2>$null | Out-Null
-Get-CimInstance Win32_Process -Filter "Name='node.exe'" -ErrorAction SilentlyContinue |
+Get-CimInstance Win32_Process -Filter "Name='bun.exe'" -ErrorAction SilentlyContinue |
   Where-Object { $_.CommandLine -match 'index\.mjs' } |
   ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }
 Start-Sleep 2

scripts/windows/web-run.cmd

@@ -2,10 +2,10 @@
 rem punktfunk web console launcher — the action the PunktfunkWeb scheduled task runs at boot.
 rem
 rem Lays out next to the installed payload: {app}\web\web-run.cmd, {app}\web\.output\... and
-rem {app}\node\node.exe (so %~dp0 = {app}\web\). Auto-wires the console the same way the Linux
+rem {app}\bun\bun.exe (so %~dp0 = {app}\web\). Auto-wires the console the same way the Linux
 rem systemd unit does: it sources the host's mgmt bearer token + the console login password from
 rem %ProgramData%\punktfunk\, points the /api proxy at the host's loopback HTTPS mgmt API, and runs
-rem the Nitro/Node server on :3000. No env editing on a packaged install.
+rem the (self-contained, no-node_modules) Nitro server on :3000 with the bundled bun. No env editing.
 setlocal EnableExtensions
 
 set "PFDATA=%ProgramData%\punktfunk"
@@ -31,10 +31,10 @@ set "HOST=0.0.0.0"
 set "PUNKTFUNK_MGMT_URL=https://127.0.0.1:47990"
 set "NODE_TLS_REJECT_UNAUTHORIZED=0"
 
-set "NODE=%~dp0..\node\node.exe"
+set "BUN=%~dp0..\bun\bun.exe"
 set "SERVER=%~dp0.output\server\index.mjs"
-if not exist "%NODE%" (
-  echo [punktfunk-web] bundled node runtime missing at "%NODE%".
+if not exist "%BUN%" (
+  echo [punktfunk-web] bundled bun runtime missing at "%BUN%".
   exit /b 1
 )
-"%NODE%" "%SERVER%"
+"%BUN%" "%SERVER%"

scripts/windows/web-setup.ps1

@@ -1,6 +1,6 @@
 <#
   Provision the punktfunk web console after the host installer has laid down its payload
-  ({app}\web\.output, {app}\node\node.exe, {app}\web\web-run.cmd). Invoked elevated from the
+  ({app}\web\.output, {app}\bun\bun.exe, {app}\web\web-run.cmd). Invoked elevated from the
   installer's [Run] section; idempotent (safe to re-run on upgrade).
 
     1. Sets the console login password file %ProgramData%\punktfunk\web-password
@@ -71,7 +71,7 @@ $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoi
     -StartWhenAvailable -RestartInterval (New-TimeSpan -Minutes 1) -RestartCount 10 `
     -ExecutionTimeLimit (New-TimeSpan -Seconds 0)
 Register-ScheduledTask -TaskName $TaskName -Action $action -Trigger $trigger -Principal $principal `
-    -Settings $settings -Description 'punktfunk web management console (Nitro/Node SSR on :3000)' `
+    -Settings $settings -Description 'punktfunk web management console (Nitro SSR on bun, :3000)' `
     -Force | Out-Null
 Write-Host "registered scheduled task $TaskName -> $cmd"