Bake Sunshine remote admin + add one-command configured ISO builder

- Sunshine flatpak in first-boot list; autostarts with the console
  account's session (bc250-sunshine-autostart, honors CONSOLE_KID_USER)
- bc250-personalize: one-shot display names from /etc/bc250-console.conf
- build-console.sh + console.env(.example): fill in usernames/passwords/
  display names, get a fully personalized ISO — no post-install steps
  beyond per-account logins. Generated files git-ignored (credentials)
- Docs: Moonlight is the remote-admin path; RDP marked blocked by the
  mutter cursor-metadata screencast crash on GFX1013

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

console.env.example

@@ -0,0 +1,12 @@
+# Copy to console.env, fill in, then run ./build-console.sh
+# console.env is git-ignored — it holds real passwords. NEVER commit it.
+#
+# Passwords: avoid double quotes and backslashes in them.
+
+KID_USER=kid
+KID_DISPLAY="Kid"
+KID_PASSWORD=changeme
+
+PARENT_USER=parent
+PARENT_DISPLAY="Parent"
+PARENT_PASSWORD=changeme