Bake Sunshine remote admin + add one-command configured ISO builder

- Sunshine flatpak in first-boot list; autostarts with the console
  account's session (bc250-sunshine-autostart, honors CONSOLE_KID_USER)
- bc250-personalize: one-shot display names from /etc/bc250-console.conf
- build-console.sh + console.env(.example): fill in usernames/passwords/
  display names, get a fully personalized ISO — no post-install steps
  beyond per-account logins. Generated files git-ignored (credentials)
- Docs: Moonlight is the remote-admin path; RDP marked blocked by the
  mutter cursor-metadata screencast crash on GFX1013

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

files/console/usr/bin/bc250-personalize

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# One-time personalization from /etc/bc250-console.conf (written at image
+# build time by build-console.sh): applies friendly display names to the
+# accounts created by the installer. Stamps so it never re-runs — later
+# on-box renames/chfn are never overwritten.
+[ -r /etc/bc250-console.conf ] && . /etc/bc250-console.conf
+
+apply() { # $1 = user, $2 = display name
+    [ -n "$2" ] || return 0
+    id "$1" >/dev/null 2>&1 || return 0
+    chfn -f "$2" "$1" || true
+}
+
+apply "${CONSOLE_KID_USER:-kid}"       "${CONSOLE_KID_DISPLAY:-}"
+apply "${CONSOLE_PARENT_USER:-parent}" "${CONSOLE_PARENT_DISPLAY:-}"
+
+mkdir -p /var/lib/bc250
+touch /var/lib/bc250/.personalized