feat(device): stream desktop simulator media directly over SSH

[Mjones13]

Desktop Device panels connected to a VPS currently send simulator video and gestures through that VPS. Add authenticated laptop-to-Mini SSH media and input, while agents, source, discovery and device lifecycle stay on the VPS. The panel selects direct media automatically when a desktop SSH alias is configured, displays connection status, and retains authenticated proxy fallback. The raw Device Hub remains private.

Stack: #77 → #78 → #83 → #82 → #90 → #80. This PR targets feat/block-thread-messages-20261004 at b3c6f96. Do not merge or install. Current head: d315a40. Both integrations use normal history-preserving merges; parent branches are unchanged. Four initial conflicts preserve current Jones documentation, parent namespace imports/mocks, direct-grant fixtures and all check groups. PR90 integration is conflict-free.

Validation:

• At intermediate PR82 integration c175e54, 200 tests passed across 22 device modules. The 23rd module, server.test.ts, cannot load the parent's unchanged missing orchestration/NativeCreationAuthority.ts import. A harness PATH issue was corrected before this run.
• Five scoped typechecks failed on orchestration integration errors; no device-file diagnostics appeared. Scoped format/lint were not run after PR90 became the new highest layer.
• Independent correctness and security reviews found no restack issues at c175e54. Final-head correctness confirmation proves the 47-path device delta is preserved against PR90 and both check groups survive. Final security confirmation found no variance in device authentication, grants, tunnels or wiring.
• Final-head diff check passes, source is clean and PR90 ancestry is verified. New-head CI is pending. Earlier 422-test/typecheck/CI passes apply only to pre-stack 668d2e1.
• Existing compiler caches stayed unchanged and check scratch was removed. The earlier P2 Android encoder-renegotiation fallback issue remains deferred.

No runtime is installed or activated. Actual Device-panel latency, native Electron behavior and live-host authentication/reconnect/fallback qualification remain pending approved activation and owner-controlled UI measurements. Green CI is not claimed; unfinished parent integration remains a blocker.

Contributing thread: Direct Device Hub video and controls, 3699a698-f7c2-4741-b68e-94532ea728ac. Restack implementation and independent reviews: GPT-6.1 Sol/xhigh; coordination: GPT-6 Astra through the Codex harness in T3 Code.