Add embedded favicon and suppress noVNC secure-context warning

- serve /favicon.ico outside session middleware so it loads on the login
  page too (was 404 via the catch-all -> requireSession redirect)
- add embedded internal/server/static/favicon.ico (monitor icon) and
  <link rel=icon> on the login page and vnc.html
- in vnc.html wrap console.error before importing core/rfb.js to drop only
  the harmless 'noVNC requires a secure context (TLS). Expect crashes!' line
  (plain VNC-password auth uses pure-JS DES, not crypto.subtle); reword the
  now-redundant disconnect hint
- update AGENTS.md with the favicon route and the secure-context note

internal/server/server.go

@@ -58,6 +58,11 @@ func (s *Server) Handler() http.Handler {
 
 	mux.Handle(s.cfg.RelayPath, s.requireSession(http.HandlerFunc(s.handleRelay)))
 	mux.Handle(s.cfg.NoVNCPath, s.requireSession(http.HandlerFunc(s.serveNoVNCPage)))
+
+	// favicon is fetched by the browser on every page (incl. the login form);
+	// serve it without a session so it doesn't redirect to /login and 404.
+	mux.HandleFunc("/favicon.ico", s.handleFavicon)
+
 	mux.Handle("/", s.requireSession(http.HandlerFunc(s.handleIndexOrStatic)))
 
 	return s.logRequest(mux)
@@ -110,6 +115,19 @@ func (s *Server) handleRelay(w http.ResponseWriter, r *http.Request) {
 	s.relay.ServeHTTP(w, r)
 }
 
+// handleFavicon serves the embedded favicon.ico with a long cache. It is
+// registered outside requireSession so it loads on the login page too.
+func (s *Server) handleFavicon(w http.ResponseWriter, r *http.Request) {
+	data, err := fs.ReadFile(s.static, "favicon.ico")
+	if err != nil {
+		http.NotFound(w, r)
+		return
+	}
+	w.Header().Set("Content-Type", "image/x-icon")
+	w.Header().Set("Cache-Control", "public, max-age=604800")
+	_, _ = w.Write(data)
+}
+
 func (s *Server) serveNoVNCPage(w http.ResponseWriter, r *http.Request) {
 	if data, err := fs.ReadFile(s.static, "vnc.html"); err == nil {
 		w.Header().Set("Content-Type", "text/html; charset=utf-8")