feat(web): management console — TanStack Start + orval + shadcn + Paraglide

Browser UI for the host's management REST API (mgmt.rs / docs/api/openapi.json).

Stack, exactly as specified:
- TanStack Start (Vite, SPA mode) — file-based routes, SSR shell + client hydration.
- React Query via orval codegen from the checked-in OpenAPI spec: a custom fetch mutator
  (src/api/fetcher.ts) centralizes the base URL, the bearer token (Settings → localStorage),
  JSON, and a throwing ApiError; the query client skips retries on 4xx. orval returns the
  response body directly (includeHttpResponseReturnType:false) so a query's `.data` is the
  typed payload; GET→useQuery, POST/DELETE→useMutation by method.
- shadcn/ui on Tailwind v4 (CSS-first tokens, dark-first) — button/card/badge/input/label/
  table/skeleton primitives hand-authored from the canonical source.
- Paraglide i18n (en + de) with a reactive useLocale() hook and a language switcher.

Pages: dashboard (live status — video/audio/session/stream, stop-session + request-IDR,
2s polling), host (identity/codecs/ports), clients (paired list + unpair), pairing (PIN
submit, polls pin_pending), settings (API token + language).

Dev server proxies /api → 127.0.0.1:47990 (same-origin, no CORS; PUNKTFUNK_MGMT_URL to
override). Generated code (orval client, paraglide runtime, routeTree) is gitignored and
reproduced by `pnpm codegen` (prepare/pre* scripts). Validated live against `serve`: API
shapes match, dev proxy works, SSR shell renders the localized nav, build + tsc green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

web/src/api/fetcher.ts

@@ -0,0 +1,57 @@
+// The fetch mutator orval-generated hooks call: `apiFetch<T>(url, RequestInit)`. orval is
+// configured (includeHttpResponseReturnType: false) so `T` is the response BODY; on an HTTP
+// error we THROW an `ApiError` so React Query's `isError` works (the query client is
+// configured not to retry 4xx — see src/router.tsx).
+//
+// Centralizes the bearer token (from Settings → localStorage). In dev, requests use a
+// relative `/api/...` path that Vite proxies to the management host (same-origin, no CORS,
+// the token rides along); a production build served by the host hits the same path.
+
+const TOKEN_KEY = 'punktfunk.apiToken'
+
+export function getApiToken(): string {
+  if (typeof localStorage === 'undefined') return ''
+  return localStorage.getItem(TOKEN_KEY) ?? ''
+}
+
+export function setApiToken(token: string): void {
+  if (typeof localStorage === 'undefined') return
+  if (token) localStorage.setItem(TOKEN_KEY, token)
+  else localStorage.removeItem(TOKEN_KEY)
+}
+
+/** A failed API call. `status` is the HTTP code; `data` is the parsed `ApiError` body if any. */
+export class ApiError extends Error {
+  status: number
+  data: unknown
+  constructor(status: number, data: unknown, message?: string) {
+    super(message ?? `API error ${status}`)
+    this.name = 'ApiError'
+    this.status = status
+    this.data = data
+  }
+}
+
+export async function apiFetch<T>(url: string, options?: RequestInit): Promise<T> {
+  const token = getApiToken()
+  const headers = new Headers(options?.headers)
+  headers.set('Accept', 'application/json')
+  if (token) headers.set('Authorization', `Bearer ${token}`)
+
+  const res = await fetch(url, { ...options, headers })
+
+  const text = await res.text()
+  const body = text ? safeJson(text) : undefined
+  if (!res.ok) throw new ApiError(res.status, body, res.statusText)
+  return body as T
+}
+
+function safeJson(text: string): unknown {
+  try {
+    return JSON.parse(text)
+  } catch {
+    return text
+  }
+}
+
+export default apiFetch