feat(clients): Wake-on-LAN in apple/linux/windows/android/decky

Each client learns a host's MAC from the mDNS `mac` TXT while it's awake, persists it on the saved-host record, and — when reconnecting to an offline host — sends a magic packet before connecting, plus an explicit "Wake host" action. Apple wraps the C-ABI; linux/windows call the core fn directly (linux also gains a --wake CLI mode); android via a new nativeWakeOnLan JNI export (the mDNS browse record gains a 7th mac field); decky shells out to the linux client's --wake before launching the stream.

iOS/tvOS need the managed com.apple.developer.networking.multicast entitlement (pending Apple approval), so the wake path + UI are gated off via PunktfunkConnection.wakeOnLANAvailable and the entitlement is commented out — keeping iOS/tvOS releasable. MAC-learning stays active on every platform so it lights up the moment it's ungated. macOS works today.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

clients/apple/Sources/PunktfunkKit/Connection/HostDiscovery.swift

@@ -31,6 +31,12 @@ public struct DiscoveredHost: Identifiable, Sendable, Equatable {
     /// reduced-security TOFU "Trust" path. A missing/unknown `pair` field is NOT optional:
     /// pairing is mandatory unless this is true (the policy authority is the host's advert).
     public let allowsTofu: Bool
+    /// Wake-on-LAN MAC address(es) the host advertised (mDNS `mac` TXT, comma-separated
+    /// `aa:bb:cc:dd:ee:ff`, routed NIC first). Empty when not advertised. A client persists these
+    /// onto the saved host so it can wake it after it sleeps; advisory/unauthenticated (a wrong
+    /// value only makes a wake fail — the magic packet is inert and the fingerprint still gates
+    /// the connection).
+    public let macAddresses: [String]
 }
 
 @MainActor
@@ -111,10 +117,15 @@ public final class HostDiscovery: ObservableObject {
         var fp: String?
         var pair: String?
         var id: String?
+        var macs: [String] = []
         if case let .bonjour(txt) = result.metadata {
             fp = Self.entry(txt, "fp")
             pair = Self.entry(txt, "pair")
             id = Self.entry(txt, "id")
+            macs = (Self.entry(txt, "mac") ?? "")
+                .split(separator: ",")
+                .map { $0.trimmingCharacters(in: .whitespaces) }
+                .filter { !$0.isEmpty }
         }
         let conn = NWConnection(to: result.endpoint, using: .udp)
         connections[key] = conn
@@ -129,7 +140,7 @@ public final class HostDiscovery: ObservableObject {
                             id: (id?.isEmpty == false) ? id! : name,
                             name: name, host: address, port: port.rawValue,
                             fingerprintHex: fp, requiresPairing: pair == "required",
-                            allowsTofu: pair == "optional")
+                            allowsTofu: pair == "optional", macAddresses: macs)
                         self.publish()
                     }
                     conn.cancel()

clients/apple/Sources/PunktfunkKit/Connection/PunktfunkConnection.swift

@@ -67,6 +67,53 @@ func withOptionalCString<R>(_ s: String?, _ body: (UnsafePointer<CChar>?) -> R)
     return s.withCString { body($0) }
 }
 
+public extension PunktfunkConnection {
+    /// Whether the Wake-on-LAN broadcast path is usable on this platform/build. macOS can always
+    /// broadcast (its App Sandbox network entitlements cover it). iOS/tvOS need the managed
+    /// `com.apple.developer.networking.multicast` entitlement, which is GATED pending Apple's
+    /// approval (see `Config/Punktfunk.entitlements`) — until it's granted, sending a broadcast is
+    /// blocked by the OS, so the wake path + its UI are gated off there to avoid a dead action.
+    /// The MAC-learning path stays active on every platform, so flipping this on once the
+    /// entitlement lands makes wake work immediately. ON APPROVAL: change `#if os(macOS)` below to
+    /// `true` for iOS/tvOS too (and uncomment the entitlement).
+    static var wakeOnLANAvailable: Bool {
+        #if os(macOS)
+        return true
+        #else
+        return false
+        #endif
+    }
+
+    /// Send a Wake-on-LAN magic packet to wake a sleeping host. `macs` are the host's NIC MAC(s)
+    /// (`aa:bb:cc:dd:ee:ff`, learned from its mDNS `mac` TXT while awake); malformed entries are
+    /// skipped. `lastKnownIP`, when set, is additionally unicast. The core broadcasts to every
+    /// interface's subnet-directed broadcast + 255.255.255.255 on ports 9/7, repeated.
+    ///
+    /// Returns true if at least one datagram went out. Does blocking sends — call OFF the main
+    /// thread. On iOS/tvOS this requires the `com.apple.developer.networking.multicast` entitlement
+    /// (broadcast is otherwise blocked by the OS); macOS needs only the existing network entitlements.
+    @discardableResult
+    static func wakeOnLAN(macs: [String], lastKnownIP: String? = nil) -> Bool {
+        var bytes: [UInt8] = []
+        var count = 0
+        for mac in macs {
+            let parts = mac.split(separator: ":")
+            guard parts.count == 6 else { continue }
+            let octets = parts.compactMap { UInt8($0, radix: 16) }
+            guard octets.count == 6 else { continue }
+            bytes.append(contentsOf: octets)
+            count += 1
+        }
+        guard count > 0 else { return false }
+        let rc: Int32 = bytes.withUnsafeBufferPointer { buf in
+            withOptionalCString(lastKnownIP) { ip in
+                punktfunk_wake_on_lan(buf.baseAddress, UInt(count), ip)
+            }
+        }
+        return rc == statusOK
+    }
+}
+
 public final class PunktfunkConnection {
     private var handle: OpaquePointer?
     /// Set by close() before it contends for the plane locks: the pullers see it at their