feat(gui): list connected viewers and let the host kick them

Track viewers by endpoint id instead of a bare count. The JSON event
stream gains viewer_joined / viewer_left (each carrying the id),
replacing viewer_count; active/max still ride along so the count
display is unchanged.

The host screen now renders one row per connected viewer with a Kick
button. Clicking it sends `kick <id>` to the headless child over a new
stdin command channel, which the host turns into a per-viewer
CancellationToken cancel; the existing teardown path then emits the
leave, so a kick and a self-disconnect look identical downstream.

The stdin channel only runs under --output json (the GUI shell-out) and
on a detached OS thread, so a read parked on stdin can't hold up the
host's Ctrl+C shutdown.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/common/output.rs

@@ -22,7 +22,11 @@ pub fn set_json(enabled: bool) {
     JSON_ENABLED.store(enabled, Ordering::Relaxed);
 }
 
-fn json_enabled() -> bool {
+/// Whether the JSON event stream is on — i.e. we're being driven by a
+/// machine front-end (the `--gui` shell-out) rather than a human terminal.
+/// Gates features that only make sense under that front-end, like the
+/// stdin command channel the host reads `kick` requests from.
+pub fn json_enabled() -> bool {
     JSON_ENABLED.load(Ordering::Relaxed)
 }
 
@@ -42,8 +46,12 @@ pub enum Event<'a> {
         max_viewers: u32,
         max_viewers_source: &'a str,
     },
-    /// Active viewer count changed.
-    ViewerCount { active: u32, max: u32 },
+    /// A viewer joined. `id` is the viewer's endpoint id; `active` is the new
+    /// total after the join.
+    ViewerJoined { id: &'a str, active: u32, max: u32 },
+    /// A viewer left — disconnected on their own or kicked by the host. `id`
+    /// is the viewer's endpoint id; `active` is the new total after.
+    ViewerLeft { id: &'a str, active: u32, max: u32 },
     /// Capture pipeline lifecycle (spawned on first viewer, torn down on last).
     Capture { state: CaptureState },
     /// A viewer was turned away (host full, or capture spawn failed).