[mikulicf]

Adds optional host enforcement for Moonlight V+ managed access. A protected policy file, written by an authenticated host agent, authorizes exact client certificates for short-lived direct streams. Revocation is checked on HTTPS and RTSP requests and terminates existing streams; missing or expired policy fails closed.

Managed mode disables legacy pairing, discovery, and UPnP, requires transport encryption, and binds the administration interface to loopback. The patch also tightens legacy certificate identity checks and includes upstream input/control packet bounds fixes. No backend address or deployment credential is built in.

Restores the FFmpeg 8 dependency revision expected by the encoder teardown code. The stale FFmpeg 7 pin caused AMD AMF encoder probing to hang; the updated native package completes probing and opens the managed listener.

Validation:

• CI run 35366266907 passed the Windows build/package and production-policy tests at f0309d8a. Policy tests cover unknown/derived certificates, expiration, revocation, malformed data, permission bounds, and size limits.
• The resulting Windows artifact passed a local RX 9060 XT startup probe: H.264, HEVC, and AV1 AMF encoders detected; managed protocol 1 listener ready in 14.4 seconds. The isolated probe process was stopped afterward. This checks startup, not sustained streaming performance.
• Final-client managed streaming beyond 90 seconds, idle-overlay renewal, and live-stream revocation remain pending while trusted distribution/signing for the companion client is resolved. This PR remains a draft until those native checks pass.

Deployment instructions document service identity, protected policy files, direct networking, and the trust boundary of a shared Windows desktop.