feat(run): sync UltraVNC password from run.bat + clearer noVNC errors

- run.bat: call scripts/ensure-vnc-password.ps1 so the password typed once
  also sets the UltraVNC service VNC password (UAC only when it differs);
  skip --spawn when 5900 is already taken (don't launch a 2nd winvnc).
- scripts/ensure-vnc-password.ps1: new - compares the password against
  %ProgramData%\UltraVNC\ultravnc.ini (reverse-engineered UltraVNC DES
  obfuscation) and only writes+restarts the service when it differs.
- scripts/set-vnc-password.bat: set UltraVNC service VNC password as admin
  (createpassword/setpasswd + verify, GUI fallback). Manual fallback.
- internal/server/static/vnc.html: don't let the generic 'disconnect'
  banner overwrite the specific 'securityfailure' reason (noVNC's
  disconnect event has no reason field, so it always said 'unknown').
- AGENTS.md: document the above (scripts, run.bat, UltraVNC service note).

run.bat

@@ -82,6 +82,11 @@ echo
 goto getpw
 :gotpw
 
+REM --- 4b. Sync UltraVNC password with the one entered (only when it differs) ---
+echo ‘¨­åà®­¨§¨àãî ¯ à®«ì UltraVNC á ¢¢¥¤ñ­­ë¬. �ਠ­¥á®¢¯ ¤¥­¨¨ § ¯à®á¨â ¯à ¢   ¤¬¨­¨áâà â®à ...
+powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0scripts\ensure-vnc-password.ps1" -Password "%PW%"
+if errorlevel 1 echo [¯à¥¤ã¯à¥¦¤¥­¨¥] �¥ 㤠«®áì ᨭåà®­¨§¨à®¢ âì ¯ à®«ì UltraVNC - ¯à®¤®«¦ î.
+
 REM --- 5. •íè ¯ à®«ï + â®â ¦¥ ¯ à®«ì ¤«ï VNC-á¥à¢¥à  ---
 echo ƒ¥­¥à¨àãî åíè ¯ à®«ï ...
 for /f "delims=" %%i in ('web-vnc.exe --gen-hash "%PW%"') do set "HASH=%%i"
@@ -104,7 +109,14 @@ REM --- 7.
 echo ‡ ¯ã᪠î web-vnc ­  http://localhost:8080
 echo Žáâ ­®¢¨âì: Ctrl+C
 echo.
-web-vnc.exe --password-hash "%HASH%" %SPAWNARGS% --spawn --listen :8080
+REM --- 6b. 5900 already listening? -> do NOT spawn a 2nd VNC server (avoid conflict with the UltraVNC service) ---
+set "SPAWNFLAG=--spawn"
+powershell -NoProfile -Command "try{$c=New-Object Net.Sockets.TcpClient('127.0.0.1',5900);$c.Close();exit 0}catch{exit 1}"
+if not errorlevel 1 (
+  echo VNC-á¥à¢¥à 㦥 á«ãè ¥â 127.0.0.1:5900 - ¯®¤ª«îç îáì ª ­¥¬ã ¡¥§ --spawn.
+  set "SPAWNFLAG="
+)
+web-vnc.exe --password-hash "%HASH%" %SPAWNARGS% %SPAWNFLAG% --listen :8080
 echo.
 echo ‘¥à¢¥à ®áâ ­®¢«¥­.
 pause