Bake Sunshine remote admin + add one-command configured ISO builder

- Sunshine flatpak in first-boot list; autostarts with the console
  account's session (bc250-sunshine-autostart, honors CONSOLE_KID_USER)
- bc250-personalize: one-shot display names from /etc/bc250-console.conf
- build-console.sh + console.env(.example): fill in usernames/passwords/
  display names, get a fully personalized ISO — no post-install steps
  beyond per-account logins. Generated files git-ignored (credentials)
- Docs: Moonlight is the remote-admin path; RDP marked blocked by the
  mutter cursor-metadata screencast crash on GFX1013

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

files/console/usr/bin/bc250-sunshine-autostart

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# Start the Sunshine streaming host in the console (kid) account's session,
+# so the parent can connect with Moonlight whenever the console is in use.
+# Sunshine replaces RDP as the remote-admin path: GNOME RDP crashes mutter
+# on the BC-250 (cursor-metadata screencast segfault, mutter 50.3).
+[ -r /etc/bc250-console.conf ] && . /etc/bc250-console.conf
+[ "$(id -un)" = "${CONSOLE_KID_USER:-kid}" ] || exit 0
+flatpak info dev.lizardbyte.app.Sunshine >/dev/null 2>&1 || exit 0
+exec systemctl --user enable --now app-dev.lizardbyte.app.Sunshine.service