HydraIssues

## Context

A single tile-tap on the Rupelmonde kiosk currently spawns **three separate Qt processes** and at least as many window transitions:

1. `HydraExperienceNet kiosk` — shows the experience grid.
2. `HydraExperienceNet pair --headless <host>` — pairs with Sunshine (v6.1.22+ has `--headless` so no window flashes here now, thanks to Phase 1).
3. `HydraExperienceNet stream <host> <app>` — loads the CliStartStreamSegue then StreamSegue then stream; has its own ApplicationWindow and its own fullscreen Space.

Each one produces a visible transition. The kiosk window is hidden via hydraheadflatscreen's `/api/v1/window/hide` during streaming and shown again via `/api/v1/window/show` after exit. Process lifecycle, Space transitions, pair subprocess, stream subprocess — a lot of state to manage for what should be a single UX of grid → loading → stream → grid.

Phase 1 (issue #99 / v6.1.22) removed the pair window flash by making the pair subcommand headless. That leaves two processes and two window transitions per launch.

## Goal

Run the whole kiosk flow in a single Qt process with a single ApplicationWindow. Transitions happen as StackView pushes/pops inside that one window.

```
kiosk process (and only process): grid → loading → stream → grid
```

## Technical approach

Moonlight-Qt already has all the primitives as QObjects usable from QML without subprocesses:

- `ComputerManager` / `NvComputer` — handles pairing via existing APIs. Already used by the `pair` subcommand; can be instantiated and driven inside the kiosk process.
- `Session` (in `streaming/session.{h,cpp}`) — regular QObject. `StreamSegue.qml` already takes a `Session` property and drives the whole stream lifecycle.

Changes in `hydra-experiencenet`:

1. In `KioskView.qml`'s `startStream(experienceName)`: instead of POSTing to the agent's `/api/v1/stream/start` (which spawns a stream subprocess), construct a `Session` in C++ / expose one to QML with the right `NvComputer` + `NvApp`, push `StreamSegue.qml` onto the StackView (which already exists in the kiosk ApplicationWindow), pass it the Session. The stream renders inside the kiosk's own SDL/Metal surface.
2. Pairing runs in-process before the Session is created — call into ComputerManager directly; no subprocess invocation.
3. Exit overlay's `triggerExitFromMenu` calls `Session::setShouldExit(false)` (already does); `StreamSegue`'s existing `sessionFinished` handler pops back to the grid with `stackView.pop()`.

Changes in `hydraheadflatscreen`:

- `startMoonlightStream`, `hideKioskWindow`, `showKioskWindow`, `waitForStreamExit` all become unused. Delete.
- `pairWithSunshine` becomes unused (pair happens in-process on the Qt side). Delete.
- `LocalAPI.startStream` — optionally keep as a thin RPC the kiosk can call back into for auto-update / config refresh, but the actual stream launch moves into the kiosk.
- Agent's role shrinks to: auto-update the kiosk binary, fetch head config, maintain WireGuard tunnel. No subprocess spawning, no window hide/show dance.

## Benefits

- **Zero process switches** between grid and stream.
- **Zero window flashes** — everything in one NSWindow / QQuickWindow.
- **Simpler state** — no pair subprocess, no stream subprocess, no hide/show RPC, no `waitForStreamExit` goroutine.
- **No Space transition** between kiosk and stream — same Qt window just switches which QML view is on the StackView.

## Tradeoffs / risks

- Moderate refactor: ~200-300 LOC net (mostly deletion from the agent, moderate addition in `KioskView.qml` / supporting C++ to construct Session + NvComputer inside the kiosk process).
- Coupling: the kiosk process now depends directly on the Moonlight streaming pipeline (ComputerManager, Session, decoder init). Currently it only depends on its own grid UI plus an HTTP call to the agent.
- Any crash in the streaming pipeline now also takes down the kiosk. Today a stream subprocess crash is contained. Need to ensure the streaming code is robust or add a supervisor that can re-launch the kiosk process on crash.
- Debugging: stream logs today land in `/tmp/Moonlight-<pid>.log` per stream subprocess. Once merged into kiosk, they go to whatever log Qt uses for the kiosk (likely `/tmp/Moonlight-*.log` still, but only one rolling file per kiosk lifetime).

## Verification plan

1. Grid → tile tap → stream renders. Single NSWindow throughout (verify with `osascript -e 'tell application "System Events" to count windows of process "HydraExperienceNet"'` returning 1 at each step, plus the always-on-top exit overlay Tool window = 2).
2. Tap exit overlay → stream disconnects cleanly → grid reappears in the same window with no flash.
3. 5-minute stability test on peppy-dumpling-32 (no process respawns, no window flickers).

## Scope

- Does NOT include: rewriting the streaming pipeline. We reuse Moonlight-Qt's existing `Session` + `ComputerManager` verbatim.
- Does NOT include: changing the exit overlay — that stays as its own `QQuickWindow` with `NSWindowCollectionBehaviorCanJoinAllSpaces`.
- Blocked by: nothing. Can be started after Phase 1 is field-verified.