feat(packaging/web): bundle the web console into the apt install (punktfunk-web)

Every user needs the console for pairing, so ship it via apt, auto-wired to the
host — no manual bun/env setup. New punktfunk-web .deb (Architecture: all,
Depends: nodejs >= 20 — runs the node-server build under apt-native node, no
bundled bun):

- packaging/debian/build-web-deb.sh: stages web/.output (server + public) + a
  /usr/bin/punktfunk-web-server wrapper (node) + the systemd --user units + the
  web.env template + docs. Refuses a bun bundle (Bun.serve) as a wrong-preset guard.
- scripts/punktfunk-web.service: --user unit on :3000, EnvironmentFile sources the
  host's ~/.config/punktfunk/mgmt-token (the shared bearer) + the generated
  web-password; sets PUNKTFUNK_MGMT_URL=https://127.0.0.1:47990 +
  NODE_TLS_REJECT_UNAUTHORIZED=0 (loopback self-signed cert). Restart=on-failure
  rides out the host-writes-token-first ordering.
- scripts/punktfunk-web-init.service + web-init.sh: --user one-shot that generates
  the login password (a .deb postinst runs as root → wrong $HOME) and surfaces it
  to the journal.
- build-deb.sh: punktfunk-host now Recommends punktfunk-web (apt pulls it by
  default; headless boxes opt out with --no-install-recommends).
- deb.yml: build the web console + smoke-boot it under node (gate the .deb on a
  real /login 200) + build-web-deb.sh; the publish loop globs it automatically.
- web/{.env.example,web.env.example}: document the auto-wiring vs a manual deploy.

End state: `apt install punktfunk-host` pulls punktfunk-web; enable both --user
services; the console logs in (password from the journal) and proxies the host's
HTTPS mgmt API with the shared token — zero hand-edited env. Local .deb build +
node smoke-boot verified.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/punktfunk-web-init.service

@@ -0,0 +1,17 @@
+# punktfunk web console first-run setup — systemd USER one-shot.
+#
+# Generates the console login password (PUNKTFUNK_UI_PASSWORD) in the streaming user's
+# ~/.config/punktfunk on first start, surfaced to the --user journal for retrieval. A .deb postinst
+# runs as root (wrong $HOME), so credential generation must happen as the user — hence this unit.
+# Pulled in by punktfunk-web.service (Wants=); also runnable directly.
+[Unit]
+Description=punktfunk web console first-run setup (login password)
+ConditionPathExists=!%h/.config/punktfunk/web-password
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/share/punktfunk-web/web-init.sh
+
+[Install]
+WantedBy=default.target

scripts/punktfunk-web.service

@@ -0,0 +1,30 @@
+# punktfunk management web console — systemd USER unit (Nitro/Node SSR, port 3000).
+#
+# Installed by the punktfunk-web .deb to /usr/lib/systemd/user/. AUTO-WIRED — no env editing:
+# it sources the host's mgmt token + the generated login password, and points at the host's
+# loopback HTTPS mgmt API (self-signed cert → NODE_TLS_REJECT_UNAUTHORIZED for the proxy's only
+# outbound hop, which is loopback). Enable per user:
+#   systemctl --user enable --now punktfunk-web
+[Unit]
+Description=punktfunk management web console
+# web-init generates the login password; the host writes the mgmt token. Order after both.
+After=punktfunk-web-init.service punktfunk-host.service
+Wants=punktfunk-web-init.service
+
+[Service]
+Type=simple
+# Both are KEY=VALUE files. mgmt-token is REQUIRED (written by the host's `serve`); if absent the
+# unit fails + Restart retries until the host has created it. web-password is '-' optional (web-init
+# creates it first, but a manual operator may inject PUNKTFUNK_UI_PASSWORD another way).
+EnvironmentFile=%h/.config/punktfunk/mgmt-token
+EnvironmentFile=-%h/.config/punktfunk/web-password
+Environment=PUNKTFUNK_MGMT_URL=https://127.0.0.1:47990
+Environment=NODE_TLS_REJECT_UNAUTHORIZED=0
+Environment=PORT=3000
+Environment=HOST=0.0.0.0
+ExecStart=/usr/bin/punktfunk-web-server
+Restart=on-failure
+RestartSec=2
+
+[Install]
+WantedBy=default.target

scripts/web-init.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+# First-run setup for the punktfunk web console (run by punktfunk-web-init.service as the user):
+# generate the login password once, in the streaming user's config dir, and surface it to the
+# journal. The mgmt token is NOT created here — the host owns it (~/.config/punktfunk/mgmt-token).
+set -eu
+
+DIR="${XDG_CONFIG_HOME:-$HOME/.config}/punktfunk"
+mkdir -p "$DIR"
+chmod 700 "$DIR" 2>/dev/null || true
+PWFILE="$DIR/web-password"
+
+if [ ! -s "$PWFILE" ]; then
+    # URL/shell-safe password (no /+= so it's a clean EnvironmentFile value).
+    PW=$(head -c 18 /dev/urandom | base64 | tr -d '/+=' | cut -c1-20)
+    (umask 077; printf 'PUNKTFUNK_UI_PASSWORD=%s\n' "$PW" > "$PWFILE")
+    chmod 600 "$PWFILE" 2>/dev/null || true
+    echo "punktfunk web console login password generated: $PW"
+    echo "(stored in $PWFILE — open http://<host-ip>:3000 and log in)"
+fi