feat(packaging): nix web console + plugin/script runner everywhere; fix tray zbus/tokio crash

Ship the management web console and the plugin/script runner across the packaging
matrix, and fix a Linux tray startup crash.

- nix: add punktfunk-web (Nitro SSR on bun) and punktfunk-scripting (Effect runner),
  with services.punktfunk.{web,scripting} modules. Both bun node_modules come from
  fixed-output derivations pinned to real deps hashes; patchShebangs the web
  node_modules so orval/paraglide/vite run in the sandbox. Validated on x86_64-linux
  (nix build .#punktfunk-{web,scripting,tray,host} all green).

- punktfunk-scripting now ships for deb/rpm/arch/nix/windows, mirroring the web-console
  mechanics (vendored bun on deb/rpm/arch, pkgs.bun on nix; one self-contained
  `bun build --target=bun` bundle). Opt-in: host Recommends it, but the systemd --user
  unit ships un-started (Windows registers its scheduled task disabled).

- fix(tray): build punktfunk-tray in its OWN cargo invocation on nix/rpm/arch. Cargo
  unifies features across one `cargo build`, so co-building the tray with the host pulls
  the host's ashpd->zbus/tokio onto the tray's shared zbus and it panics at startup
  ("there is no reactor running, must be called from the context of a Tokio 1.x
  runtime"). Isolated, the tray's zbus stays on async-io. The .deb already did this;
  runtime-verified on nix.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

flake.nix

@@ -52,7 +52,7 @@
       packages = forAllSystems (system:
         let pf = packagesFor system;
         in {
-          inherit (pf) punktfunk-host punktfunk-client;
+          inherit (pf) punktfunk-host punktfunk-client punktfunk-web punktfunk-scripting punktfunk-tray;
           default = pf.punktfunk-host;
         });
 
@@ -68,14 +68,26 @@
             type = "app";
             program = "${pf.punktfunk-client}/bin/punktfunk-client";
           };
+          # `nix run .#punktfunk-web` — the console (auto-wire the mgmt token / cert via env or the
+          # NixOS module; see packaging/nix/README.md).
+          punktfunk-web = {
+            type = "app";
+            program = "${pf.punktfunk-web}/bin/punktfunk-web-server";
+          };
+          # `nix run .#punktfunk-scripting -- --list` — the plugin/script runner.
+          punktfunk-scripting = {
+            type = "app";
+            program = "${pf.punktfunk-scripting}/bin/punktfunk-scripting";
+          };
           default = self.apps.${system}.punktfunk-host;
         });
 
-      # `nix flake check` builds both packages.
+      # `nix flake check` builds every package (web included — needs its deps hash filled in, see
+      # packaging/nix/README.md).
       checks = forAllSystems (system:
         let pf = packagesFor system;
         in {
-          inherit (pf) punktfunk-host punktfunk-client;
+          inherit (pf) punktfunk-host punktfunk-client punktfunk-web punktfunk-scripting;
         });
 
       # `nix develop` — the pinned toolchain plus every system lib the workspace links, wired so