fix(web): four "fixes" from this branch that did not actually fix anything

A verification pass re-read every finding from the original sweep against the
code on this branch rather than against the commit messages. It found that four
of them were still broken, two because the edit I made was inert. Commit
messages claim; code decides.

- **The Storybook typecheck was never on.** `tsconfig.json` listed `.storybook`
  as a bare directory name, and tsc silently skips dot-prefixed directories in
  that form — so the entry typechecked nothing at all. Proved it by planting
  `export const __probe: string = 1` in `.storybook/preview.tsx` and watching
  `bun run lint` pass. `.storybook/**/*` is what actually pulls it in; the same
  probe now fails as it should.

- **The Moonlight stale-PIN reset was a no-op.** `submit.reset()` sat at the top
  of `onSubmit`, immediately before `submit.mutate(...)` — which moves the status
  to pending in the same update, so it cleared a flag that was already changing.
  The green "PIN sent" note therefore still greeted the next pairing attempt over
  an empty PIN box. It now resets on the transition that actually matters:
  `pin_pending` going false → true.

- **The session⇄game controls had the enforcement flag inverted**, and I never
  touched it. `enforced.length === 0 || …` reads an EMPTY list as "this build
  enforces everything", when the contract says the opposite in as many words:
  "Empty on a platform with no launch path (macOS), so the console can say so
  instead of offering a switch that does nothing". On exactly the platform the
  flag exists for, every control stayed live and reported success for an axis the
  host would never act on. Absent still means "assume it acts" — that is the
  compatible reading for an older host, and a different case from present-empty.

- **Logout stopped revoking after a restart.** The epoch was a module-level
  counter starting at 1, so it revoked within one process run and then reset —
  and since the seal key derives from the stable mgmt token, a cookie captured
  before a restart unsealed fine and was accepted again for the rest of its
  7-day TTL. One service restart undid the whole fix. It persists next to the
  host's config now. Verified: log out, restart the console, the captured cookie
  still 401s, a fresh login still works.

Two more the pass rated as partial, both worth closing:

- The plugin-UI response filter was a denylist of four header names, so
  `Clear-Site-Data` sailed through — a plugin error page could wipe `pf_session`
  and sign the operator out of the console, on our own origin, because the iframe
  is same-origin by design. It is an allowlist now; a plugin-supplied CSP,
  `X-Frame-Options` or CORS header no longer speaks for us either.

- A half-configured TLS setup now refuses to start instead of logging a warning
  and serving anyway. Neither shape can work — one path missing puts the login
  password on the LAN in the clear, and PUNKTFUNK_UI_SECURE without TLS marks the
  cookie Secure so the browser drops it and login can never stick. Exiting with a
  reason beats a console that looks fine and is not.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

web/nitro-entry/bun-https.mjs

@@ -48,21 +48,32 @@ const tls =
 		? { cert: Bun.file(certPath), key: Bun.file(keyPath) }
 		: undefined;
 
-// Half-configured TLS is the dangerous shape: one path set and the other missing silently drops to
-// plain HTTP, and if PUNKTFUNK_UI_SECURE is also set the session cookie is marked Secure — which a
-// browser then refuses to store over http://, so login appears to succeed and every next request is
-// unauthenticated. Both failure modes are silent, so say something.
+// Half-configured TLS is not a warning, it is a refusal.
+//
+// Two silent failures hide here, and both end with the operator staring at a console that looks
+// fine. One path set and the other missing drops to plain HTTP — the login password then crosses
+// the LAN in the clear on a server the operator believes is TLS. And PUNKTFUNK_UI_SECURE without
+// TLS marks the session cookie Secure, which a browser refuses to store over http://, so login
+// "succeeds" and every request after it is unauthenticated, forever.
+//
+// Neither state can serve a working console, so exiting is strictly better than serving a broken
+// one: a supervisor logs the reason and the operator sees a stopped service instead of a subtly
+// wrong one.
+const secureFlag = /^(1|true)$/i.test(process.env.PUNKTFUNK_UI_SECURE ?? "");
 if (Boolean(certPath) !== Boolean(keyPath)) {
 	console.error(
 		`punktfunk web console: only ${certPath ? "PUNKTFUNK_UI_TLS_CERT" : "PUNKTFUNK_UI_TLS_KEY"} is set — ` +
-			"TLS needs BOTH. Serving plain HTTP.",
+			"TLS needs BOTH. Refusing to start rather than serve the login password in the clear.",
 	);
+	process.exit(1);
 }
-if (!tls && /^(1|true)$/i.test(process.env.PUNKTFUNK_UI_SECURE ?? "")) {
+if (!tls && secureFlag) {
 	console.error(
 		"punktfunk web console: PUNKTFUNK_UI_SECURE is set but TLS is not configured. The session " +
-			"cookie will be marked Secure and dropped by the browser over http:// — login will not stick.",
+			"cookie would be marked Secure and dropped by the browser over http://, so login could " +
+			"never stick. Refusing to start — set PUNKTFUNK_UI_TLS_CERT/_KEY, or unset PUNKTFUNK_UI_SECURE.",
 	);
+	process.exit(1);
 }
 
 const server = Bun.serve({