Add embedded favicon and suppress noVNC secure-context warning

- serve /favicon.ico outside session middleware so it loads on the login
  page too (was 404 via the catch-all -> requireSession redirect)
- add embedded internal/server/static/favicon.ico (monitor icon) and
  <link rel=icon> on the login page and vnc.html
- in vnc.html wrap console.error before importing core/rfb.js to drop only
  the harmless 'noVNC requires a secure context (TLS). Expect crashes!' line
  (plain VNC-password auth uses pure-JS DES, not crypto.subtle); reword the
  now-redundant disconnect hint
- update AGENTS.md with the favicon route and the secure-context note

internal/server/static/vnc.html

@@ -4,6 +4,7 @@
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width,initial-scale=1">
 <title>Web VNC</title>
+<link rel="icon" href="/favicon.ico" type="image/x-icon">
 <style>
   html,body{margin:0;padding:0;width:100%;height:100%;background:#000;overflow:hidden}
   #screen{width:100%;height:100%;display:block}
@@ -21,6 +22,18 @@
 <div id="screen"></div>
 <div id="banner" style="display:none"></div>
 <script type="module">
+// noVNC prints "noVNC requires a secure context (TLS). Expect crashes!" whenever
+// window.isSecureContext is false (i.e. plain http over a LAN IP). For ordinary
+// VNC-password auth noVNC uses its own pure-JS DES (core/des.js) and does NOT need
+// crypto.subtle, so the warning is purely cosmetic. Suppress exactly that one line
+// (let every other console.error through) by wrapping console.error before rfb.js
+// imports and binds Log.Error to it.
+const _origConsoleError = console.error.bind(console);
+const _SECURE_CTX_RE = /noVNC requires a secure context \(TLS\)/;
+console.error = function(...args) {
+  if (args.length && typeof args[0] === "string" && _SECURE_CTX_RE.test(args[0])) return;
+  _origConsoleError(...args);
+};
 const wsURL = (location.protocol === "https:" ? "wss://" : "ws://") + location.host + "/vnc";
 const statusURL = "/api/status";
 const banner = document.getElementById("banner");
@@ -85,7 +98,7 @@ async function connect(){
     showBanner(`
       <h2>Disconnected</h2>
       <div>Reason: ${clean ? "connection closed" : "connection lost"}. See the browser console (F12) for the exact error.</div>
-      <div class="hint">The "noVNC requires a secure context (TLS)" console warning is harmless for plain VNC-password auth. A real failure is usually a VNC password mismatch.</div>
+      <div class="hint">A real failure is usually a VNC password mismatch. See the browser console (F12) for details.</div>
       <button onclick="location.reload()">Retry</button>`);
   });
   window.addEventListener("beforeunload", () => { try { rfb.disconnect(); } catch(e){} });