feat(packaging/web): bundle the web console into the apt install (punktfunk-web)

Every user needs the console for pairing, so ship it via apt, auto-wired to the
host — no manual bun/env setup. New punktfunk-web .deb (Architecture: all,
Depends: nodejs >= 20 — runs the node-server build under apt-native node, no
bundled bun):

- packaging/debian/build-web-deb.sh: stages web/.output (server + public) + a
  /usr/bin/punktfunk-web-server wrapper (node) + the systemd --user units + the
  web.env template + docs. Refuses a bun bundle (Bun.serve) as a wrong-preset guard.
- scripts/punktfunk-web.service: --user unit on :3000, EnvironmentFile sources the
  host's ~/.config/punktfunk/mgmt-token (the shared bearer) + the generated
  web-password; sets PUNKTFUNK_MGMT_URL=https://127.0.0.1:47990 +
  NODE_TLS_REJECT_UNAUTHORIZED=0 (loopback self-signed cert). Restart=on-failure
  rides out the host-writes-token-first ordering.
- scripts/punktfunk-web-init.service + web-init.sh: --user one-shot that generates
  the login password (a .deb postinst runs as root → wrong $HOME) and surfaces it
  to the journal.
- build-deb.sh: punktfunk-host now Recommends punktfunk-web (apt pulls it by
  default; headless boxes opt out with --no-install-recommends).
- deb.yml: build the web console + smoke-boot it under node (gate the .deb on a
  real /login 200) + build-web-deb.sh; the publish loop globs it automatically.
- web/{.env.example,web.env.example}: document the auto-wiring vs a manual deploy.

End state: `apt install punktfunk-host` pulls punktfunk-web; enable both --user
services; the console logs in (password from the journal) and proxies the host's
HTTPS mgmt API with the shared token — zero hand-edited env. Local .deb build +
node smoke-boot verified.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

web/.env.example

@@ -1,5 +1,7 @@
-# punktfunk web — management console (Bun/Nitro server) configuration.
-# Copy to `.env` (gitignored) or set these in the environment of `bun run start`.
+# punktfunk web — management console (Nitro/Node server) configuration.
+# Copy to `.env` (gitignored) or set these in the environment of `node .output/server/index.mjs`.
+# NOTE: on a packaged install (the punktfunk-web .deb) you edit NOTHING — the systemd --user units
+# auto-wire these from the host's ~/.config/punktfunk/{mgmt-token,web-password}. See web.env.example.
 
 # REQUIRED in production: the shared login password for the console. The built Nitro
 # server fails CLOSED (503 on every request) if this is unset, so a LAN-exposed server

web/web.env.example

@@ -0,0 +1,22 @@
+# punktfunk web console — packaged config reference.
+#
+# On a `apt install punktfunk-web` install you DO NOT edit anything: the systemd --user units wire
+# everything automatically —
+#   punktfunk-web.service sets PUNKTFUNK_MGMT_URL=https://127.0.0.1:47990, NODE_TLS_REJECT_UNAUTHORIZED=0,
+#   PORT=3000, HOST=0.0.0.0, and sources:
+#     ~/.config/punktfunk/mgmt-token    (written by the host's `serve` — the shared bearer token)
+#     ~/.config/punktfunk/web-password  (written by punktfunk-web-init — the console login password)
+#
+# This file documents the variables for a MANUAL deploy (running `node .output/server/index.mjs`
+# yourself). The mgmt API is HTTPS with the host's self-signed loopback cert, so the proxy needs
+# NODE_TLS_REJECT_UNAUTHORIZED=0 (its only outbound TLS hop is that loopback connection).
+PUNKTFUNK_MGMT_URL=https://127.0.0.1:47990
+NODE_TLS_REJECT_UNAUTHORIZED=0
+PORT=3000
+HOST=0.0.0.0
+
+# Match the host's ~/.config/punktfunk/mgmt-token (auto-generated by the host if unset):
+PUNKTFUNK_MGMT_TOKEN=
+
+# Console login password (fails closed if unset on the built server):
+PUNKTFUNK_UI_PASSWORD=