Self-healing headless, working JARVIS install fixes, public-safe docs

This bundles every fix we made debugging the first real install plus a
comprehensive troubleshooting reference. Working tree is now PII-safe for
public distribution: hostname-based default mode is driven by a HEADLESS_HOSTS
env var instead of a hardcoded literal; docs use placeholders for hostnames
and LAN IPs.

Self-healing headless management
- bin/sunshine-prestart.sh (new): runs as systemd ExecStartPre. Resolves the
  Hyprland instance signature from XDG_RUNTIME_DIR/hypr when systemd-user env
  didn't propagate it. Reduces to exactly one headless output by keeping the
  lowest-numbered HEADLESS-N and removing the rest. Rewrites the managed
  sunshine.conf's output_name line to match the surviving name — Hyprland's
  HEADLESS-N counter is monotonic and ignores the optional name argument to
  'output create headless', so without active sync output_name drifts off
  HEADLESS-1 after the first restart cycle.
- bin/sunshine-stream-do.sh: dropped the hardcoded MON=HEADLESS-1. Now
  discovers whatever HEADLESS-* exists via jq. Resize and workspace migration
  target the actual output.
- bin/sunshine-stream-undo.sh: reads the headless name from a state file the
  do-script wrote, with discovery fallback. Stops removing the output between
  sessions — the create/destroy race caused fatal startup encoder errors on
  the next Sunshine restart.
- files/headless-prestart.conf, files/sunshine.service: ExecStartPre now
  points at the new prestart script.
- lib/headless.sh: install_headless_hooks now installs all three scripts.
  New install_headless_prestart_dropin resolves the actual systemd unit name
  (sunshine.service vs app-dev.lizardbyte.app.Sunshine.service) and lands the
  drop-in under <unit>.service.d/.

Firewall detection
- lib/firewall.sh: _ufw_active now uses 'systemctl is-active ufw.service'
  instead of 'ufw status'. The latter requires root to read /etc/ufw state,
  so the unprivileged probe returned false and we silently skipped opening
  Sunshine's ports on hosts where ufw was actively dropping packets.

Service unit fallbacks
- lib/service.sh: ensure_sunshine_unit_present looks for sunshine.service in
  every systemd-user path first; falls back to the reverse-DNS AUR-source
  unit name; last resort drops a repo-provided fallback unit. systemctl
  reset-failed before each restart so a previous start-limit-hit doesn't
  immediately reject the new attempt.

Preflight
- lib/preflight.sh: new preflight_headless step that, only when STREAM_MODE
  is headless, surfaces missing hyprctl / jq / Hyprland reachability before
  install proceeds.

Public-safe defaults
- install.sh: streaming-mode default is now driven by HEADLESS_HOSTS env var
  (comma-separated, case-insensitive). Unset by default — every host gets
  mirror mode unless its hostname is listed or --headless is passed
  explicitly. Past versions hardcoded a specific hostname.
- README.md: replaced JARVIS-specific examples with HEADLESS_HOSTS prose.

Docs
- docs/TROUBLESHOOTING.md (new): comprehensive failure-mode reference. Every
  issue hit during the first end-to-end install, in order, with symptom →
  cause → fix → permanent prevention. Plus a "Custom keybinding to escape
  Moonlight" section and an outstanding-followups punch list (1Password
  black-rectangle workarounds, hypridle inhibit during stream, busiest-
  workspace auto-switch, jarvis.lan DNS, 1Password SSH agent timeouts).

install.sh

@@ -54,6 +54,9 @@ Environment overrides:
                      Set to 'sunshine' to build from source instead.
   OP_VAULT           1Password vault that holds the root CA (default: Private)
   OP_CA_ITEM         Item title in that vault (default: Omarchy-Stream Root CA)
+  HEADLESS_HOSTS     Comma-separated hostnames that default to headless mode.
+                     Unset by default; anything not listed defaults to mirror.
+                     Override per-invocation with --headless or --mirror.
 EOF
 }
 
@@ -85,19 +88,27 @@ while [[ $# -gt 0 ]]; do
   shift
 done
 
-# Pick streaming mode: explicit flag wins; otherwise default to headless on
-# JARVIS (the KVM-attached primary target) and mirror everywhere else.
+# Pick streaming mode: explicit flag wins; otherwise hostnames listed in the
+# HEADLESS_HOSTS env var (comma-separated, case-insensitive) default to headless
+# mode, anything else defaults to mirror. Override per-invocation with
+# --headless / --mirror.
+#
+# Example (in your shell rc or one-off):
+#   HEADLESS_HOSTS=mybox,otherbox ./install.sh
 compute_stream_mode() {
   if [[ -n "$MODE_OVERRIDE" ]]; then
     STREAM_MODE="$MODE_OVERRIDE"
     return 0
   fi
   local host_lc="${HOSTNAME_SHORT,,}"
-  if [[ "$host_lc" == "jarvis" ]]; then
-    STREAM_MODE="headless"
-  else
-    STREAM_MODE="mirror"
-  fi
+  local IFS=','
+  for h in ${HEADLESS_HOSTS:-}; do
+    if [[ "$host_lc" == "${h,,}" ]]; then
+      STREAM_MODE="headless"
+      return 0
+    fi
+  done
+  STREAM_MODE="mirror"
 }
 
 main() {