feat: replace QR remote pairing with encrypted LAN discovery

Replace session ID + PIN auth with HKDF-derived home secret and
per-session AES-256-GCM encrypted channel. Auto-start remote server
on host devices, auto-discover hosts via authenticated UDP broadcast.

lib/services/settings_service.dart

@@ -92,6 +92,7 @@ class SettingsService extends BaseSharedPreferencesService {
   static const String _keyMpvConfigPresets = 'mpv_config_presets';
   static const String _keyMaxVolume = 'max_volume';
   static const String _keyEnableDiscordRPC = 'enable_discord_rpc';
+  static const String _keyEnableCompanionRemoteServer = 'enable_companion_remote_server';
   static const String _keyAutoPip = 'auto_pip';
   static const String _keyMatchContentFrameRate = 'match_content_frame_rate';
   static const String _keyTunneledPlayback = 'tunneled_playback';
@@ -1104,6 +1105,17 @@ class SettingsService extends BaseSharedPreferencesService {
     return prefs.getBool(_keyEnableDiscordRPC) ?? false; // Default disabled
   }
 
+  // Companion Remote Server
+  Future<void> setEnableCompanionRemoteServer(bool enabled) async {
+    await prefs.setBool(_keyEnableCompanionRemoteServer, enabled);
+  }
+
+  bool getEnableCompanionRemoteServer() {
+    // Default enabled on desktop/TV, disabled on mobile
+    return prefs.getBool(_keyEnableCompanionRemoteServer) ??
+        (Platform.isMacOS || Platform.isWindows || Platform.isLinux);
+  }
+
   // Auto Picture-in-Picture (Android & iOS)
   Future<void> setAutoPip(bool enabled) async {
     await prefs.setBool(_keyAutoPip, enabled);