Bake Sunshine remote admin + add one-command configured ISO builder

- Sunshine flatpak in first-boot list; autostarts with the console
  account's session (bc250-sunshine-autostart, honors CONSOLE_KID_USER)
- bc250-personalize: one-shot display names from /etc/bc250-console.conf
- build-console.sh + console.env(.example): fill in usernames/passwords/
  display names, get a fully personalized ISO — no post-install steps
  beyond per-account logins. Generated files git-ignored (credentials)
- Docs: Moonlight is the remote-admin path; RDP marked blocked by the
  mutter cursor-metadata screencast crash on GFX1013

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

recipes/bc250-console-gnome.yml

@@ -24,7 +24,7 @@ modules:
 
   - type: script
     snippets:
-      - chmod 0755 /usr/bin/bc250-remote-setup /usr/bin/bc250-steam-bpm-autostart /usr/bin/bc250-gfn-install
+      - chmod 0755 /usr/bin/bc250-remote-setup /usr/bin/bc250-steam-bpm-autostart /usr/bin/bc250-gfn-install /usr/bin/bc250-sunshine-autostart /usr/bin/bc250-personalize
       - dconf update # compile the local.d/gdm.d console defaults into the dconf dbs
 
   - type: default-flatpaks@v1
@@ -39,6 +39,7 @@ modules:
         - com.heroicgameslauncher.hgl # Heroic: Epic + GOG
         - net.retrodeck.retrodeck # RetroDECK: retro emulation
         - org.prismlauncher.PrismLauncher # Minecraft (Java; sign in with Microsoft account)
+        - dev.lizardbyte.app.Sunshine # game-stream host: parent remote admin via Moonlight (RDP blocked by mutter bug on GFX1013)
 
   - type: systemd
     system:
@@ -47,6 +48,7 @@ modules:
         - sshd.service
         - tailscaled.service # idle until 'sudo tailscale up'
         - bc250-gfn-install.service # GeForce NOW beta from NVIDIA's flatpak repo (first boot)
+        - bc250-personalize.service # one-time display names from /etc/bc250-console.conf
       masked:
         - hhd.service # Handheld Daemon crash-loops on BC-250
         # Always-on console: hard-block every suspend path (the box must