feat(web): management console — TanStack Start + orval + shadcn + Paraglide

Browser UI for the host's management REST API (mgmt.rs / docs/api/openapi.json).

Stack, exactly as specified:
- TanStack Start (Vite, SPA mode) — file-based routes, SSR shell + client hydration.
- React Query via orval codegen from the checked-in OpenAPI spec: a custom fetch mutator
  (src/api/fetcher.ts) centralizes the base URL, the bearer token (Settings → localStorage),
  JSON, and a throwing ApiError; the query client skips retries on 4xx. orval returns the
  response body directly (includeHttpResponseReturnType:false) so a query's `.data` is the
  typed payload; GET→useQuery, POST/DELETE→useMutation by method.
- shadcn/ui on Tailwind v4 (CSS-first tokens, dark-first) — button/card/badge/input/label/
  table/skeleton primitives hand-authored from the canonical source.
- Paraglide i18n (en + de) with a reactive useLocale() hook and a language switcher.

Pages: dashboard (live status — video/audio/session/stream, stop-session + request-IDR,
2s polling), host (identity/codecs/ports), clients (paired list + unpair), pairing (PIN
submit, polls pin_pending), settings (API token + language).

Dev server proxies /api → 127.0.0.1:47990 (same-origin, no CORS; PUNKTFUNK_MGMT_URL to
override). Generated code (orval client, paraglide runtime, routeTree) is gitignored and
reproduced by `pnpm codegen` (prepare/pre* scripts). Validated live against `serve`: API
shapes match, dev proxy works, SSR shell renders the localized nav, build + tsc green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

web/src/components/query-state.tsx

@@ -0,0 +1,40 @@
+import type { ReactNode } from 'react'
+import { ApiError } from '@/api/fetcher'
+import { Skeleton } from '@/components/ui/skeleton'
+import { Button } from '@/components/ui/button'
+import { m } from '@/paraglide/messages'
+
+interface QueryStateProps {
+  isLoading: boolean
+  error: unknown
+  refetch?: () => void
+  children: ReactNode
+}
+
+/** Uniform loading/error wrapper for a query-backed view. */
+export function QueryState({ isLoading, error, refetch, children }: QueryStateProps) {
+  if (isLoading) {
+    return (
+      <div className="space-y-3">
+        <Skeleton className="h-8 w-40" />
+        <Skeleton className="h-24 w-full" />
+      </div>
+    )
+  }
+  if (error) {
+    const unauthorized = error instanceof ApiError && error.status === 401
+    return (
+      <div className="rounded-lg border border-destructive/40 bg-destructive/5 p-4 text-sm">
+        <p className="font-medium text-destructive">
+          {unauthorized ? m.common_unauthorized() : m.common_error()}
+        </p>
+        {refetch && !unauthorized && (
+          <Button variant="outline" size="sm" className="mt-3" onClick={() => refetch()}>
+            {m.common_retry()}
+          </Button>
+        )}
+      </div>
+    )
+  }
+  return <>{children}</>
+}