Persistent HEADLESS-1 + SSH-tunnel-friendly cert SANs + web UI lockdown

Two streams of fixes shipped together.

Headless persistence (root cause of "Fatal: Unable to find display or
encoder during startup")
- bin/sunshine-stream-undo.sh: stop removing HEADLESS-1 on disconnect.
  Create-on-connect / destroy-on-disconnect raced with Sunshine's startup
  encoder probe and made every restart fail with a fatal-but-misleading
  warning. The output now lives across stream sessions; sunshine-stream-
  do.sh just resizes it per client.
- files/headless-prestart.conf: systemd-user drop-in that runs
  'hyprctl output create headless' (non-fatal) before Sunshine starts, so
  HEADLESS-1 exists before the encoder probe.
- lib/headless.sh: install_headless_prestart_dropin resolves the actual
  unit name (sunshine.service or app-dev.lizardbyte.app.Sunshine.service)
  and lands the drop-in under ~/.config/systemd/user/<unit>.d/.
- lib/service.sh: enable_sunshine_service calls install_headless_prestart_
  dropin when STREAM_MODE=headless. Placed after ensure_sunshine_unit_
  present so the unit name is settled when the drop-in is written.
- install.sh: comment noting the drop-in install is deferred to the
  service-enable step.

Web UI lockdown + tunnel-friendly certs
- lib/config.sh: emits origin_web_ui_allowed = pc. Sunshine rejects web UI
  requests from anywhere other than localhost regardless of bind address.
  Streaming/pairing (47989) stays LAN-accessible. Inline comment documents
  the SSH tunnel recipe.
- lib/certs.sh: add DNS:localhost and IP:127.0.0.1 to host cert SANs so
  the tunneled https://localhost:47990 URL doesn't trigger a hostname
  mismatch. Idempotency check now requires those SANs too.

Misc.
- files/sunshine.service: fallback unit also gains the prestart ExecStartPre.
- lib/service.sh: ensure_sunshine_unit_present aliases the reverse-DNS
  Sunshine unit as sunshine.service when sunshine-bin's short-name unit
  isn't installed.

lib/headless.sh

@@ -18,3 +18,36 @@ install_headless_hooks() {
   install -m 0755 "$SCRIPT_DIR/bin/sunshine-stream-undo.sh" "$UNDO_SCRIPT"
   ok "Installed prep-cmd hooks to $HEADLESS_BIN_DIR"
 }
+
+# Install a systemd-user drop-in that pre-creates HEADLESS-1 before Sunshine
+# starts, so the encoder probe at startup sees a valid Wayland output. Without
+# this, Sunshine reports a fatal "Unable to find display or encoder during
+# startup" on every restart, even though streaming works once a client connects.
+install_headless_prestart_dropin() {
+  local dropin_src="$SCRIPT_DIR/files/headless-prestart.conf"
+  if [[ ! -f "$dropin_src" ]]; then
+    err "Drop-in source missing: $dropin_src"
+    return 1
+  fi
+
+  # Resolve the actual unit name. Prefer sunshine.service when present (alias
+  # or sunshine-bin); fall back to the AUR source pkg's reverse-DNS name.
+  local unit=""
+  for u in sunshine.service app-dev.lizardbyte.app.Sunshine.service; do
+    if systemctl --user list-unit-files "$u" >/dev/null 2>&1 \
+       && systemctl --user cat "$u" >/dev/null 2>&1; then
+      unit="$u"
+      break
+    fi
+  done
+  if [[ -z "$unit" ]]; then
+    warn "Could not resolve a sunshine unit to attach the drop-in to; skipping."
+    return 0
+  fi
+
+  local dropin_dir="$HOME/.config/systemd/user/${unit}.d"
+  mkdir -p "$dropin_dir"
+  install -m 0644 "$dropin_src" "$dropin_dir/headless-prestart.conf"
+  systemctl --user daemon-reload
+  ok "Installed headless prestart drop-in at $dropin_dir/headless-prestart.conf"
+}