feat(clients): Wake-on-LAN in apple/linux/windows/android/decky

Each client learns a host's MAC from the mDNS `mac` TXT while it's awake, persists it on the saved-host record, and — when reconnecting to an offline host — sends a magic packet before connecting, plus an explicit "Wake host" action. Apple wraps the C-ABI; linux/windows call the core fn directly (linux also gains a --wake CLI mode); android via a new nativeWakeOnLan JNI export (the mDNS browse record gains a 7th mac field); decky shells out to the linux client's --wake before launching the stream.

iOS/tvOS need the managed com.apple.developer.networking.multicast entitlement (pending Apple approval), so the wake path + UI are gated off via PunktfunkConnection.wakeOnLANAvailable and the entitlement is commented out — keeping iOS/tvOS releasable. MAC-learning stays active on every platform so it lights up the moment it's ungated. macOS works today.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

clients/windows/src/trust.rs

@@ -57,6 +57,11 @@ pub struct KnownHost {
     pub fp_hex: String,
     /// True if trust came from the SPAKE2 PIN ceremony (vs. trust-on-first-use).
     pub paired: bool,
+    /// Wake-on-LAN MAC(s) (`aa:bb:cc:dd:ee:ff`) learned from the host's mDNS `mac` TXT while it was
+    /// online, so we can wake it once it sleeps. `default` so pre-existing stores load; empty until
+    /// first learned.
+    #[serde(default)]
+    pub mac: Vec<String>,
 }
 
 #[derive(Default, Serialize, Deserialize)]
@@ -106,12 +111,36 @@ impl KnownHosts {
             h.addr = entry.addr;
             h.port = entry.port;
             h.paired |= entry.paired;
+            // A trust-decision upsert (which carries no MAC) must not wipe learned MACs.
+            if !entry.mac.is_empty() {
+                h.mac = entry.mac;
+            }
         } else {
             self.hosts.push(entry);
         }
     }
 }
 
+/// Learn/refresh a saved host's Wake-on-LAN MAC(s) from its live advert (called while the host is
+/// online, matched by fingerprint or address). No-op — and no disk write — when unchanged, so the
+/// hosts page can call it on every discovery tick without churning the store.
+pub fn learn_mac(fp_hex: &str, addr: &str, port: u16, mac: &[String]) {
+    if mac.is_empty() {
+        return;
+    }
+    let mut known = KnownHosts::load();
+    let Some(h) = known.hosts.iter_mut().find(|h| {
+        (!fp_hex.is_empty() && h.fp_hex == fp_hex) || (h.addr == addr && h.port == port)
+    }) else {
+        return;
+    };
+    if h.mac == mac {
+        return;
+    }
+    h.mac = mac.to_vec();
+    let _ = known.save();
+}
+
 /// App settings, persisted as JSON. Stringly-typed gamepad/compositor prefs so the file
 /// stays readable; parsed with `*Pref::from_name` at connect time.
 #[derive(Clone, Serialize, Deserialize)]