Bake Sunshine remote admin + add one-command configured ISO builder

- Sunshine flatpak in first-boot list; autostarts with the console
  account's session (bc250-sunshine-autostart, honors CONSOLE_KID_USER)
- bc250-personalize: one-shot display names from /etc/bc250-console.conf
- build-console.sh + console.env(.example): fill in usernames/passwords/
  display names, get a fully personalized ISO — no post-install steps
  beyond per-account logins. Generated files git-ignored (credentials)
- Docs: Moonlight is the remote-admin path; RDP marked blocked by the
  mutter cursor-metadata screencast crash on GFX1013

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

README.md

@@ -15,7 +15,7 @@ over-the-air from this Gitea's container registry.
 |---|---|
 | GPU | `cyan-skillfish-governor-smu` (BC-250 DVFS governor, from the [filippor COPR](https://copr.fedorainfracloud.org/coprs/filippor/bazzite/)), enabled |
 | Memory | `ttm.pages_limit` / `ttm.page_pool_size` kargs so the GPU can use the full 16 GB shared GDDR6 |
-| Remote admin | `openssh-server` (enabled) + `gnome-remote-desktop` (RDP); one-time `bc250-remote-setup` script; `tailscaled` enabled |
+| Remote admin | `openssh-server` (enabled); **Sunshine** auto-serves the kid's session to Moonlight; `tailscaled` enabled. (RDP via `bc250-remote-setup` exists but is blocked by a mutter/GFX1013 crash) |
 | Console behavior | All suspend paths masked, no screen lock/dim, GNOME animations off — always on, always reachable |
 | Kid experience | Steam Big Picture autostarts for the `kid` account only |
 | Apps | First-boot flatpaks: ProtonUp-Qt, Heroic, RetroDECK, Prism Launcher (Minecraft) — Steam, Firefox, auto-updates already in the Bazzite base |
@@ -25,9 +25,11 @@ over-the-air from this Gitea's container registry.
 
 ## Accounts
 
-The ISO installs **unattended** and bakes two users from
-[`iso-config.toml`](iso-config.toml): `parent` (admin/wheel) and `kid`
-(standard), both with a placeholder password to change on first login.
+Build with [`build-console.sh`](build-console.sh) + your `console.env` to
+bake real usernames, passwords, and display names directly into the ISO
+(see BUILD-CONSOLE.md). Without it, the ISO bakes the placeholder users
+from [`iso-config.toml`](iso-config.toml): `parent` (admin/wheel) and `kid`
+(standard), passwords to change on first login.
 The kid's account can be renamed post-install (see OPERATIONS.md) — the
 Big Picture autostart follows `CONSOLE_KID_USER` in `/etc/bc250-console.conf`.