feat(run): sync UltraVNC password from run.bat + clearer noVNC errors

- run.bat: call scripts/ensure-vnc-password.ps1 so the password typed once
  also sets the UltraVNC service VNC password (UAC only when it differs);
  skip --spawn when 5900 is already taken (don't launch a 2nd winvnc).
- scripts/ensure-vnc-password.ps1: new - compares the password against
  %ProgramData%\UltraVNC\ultravnc.ini (reverse-engineered UltraVNC DES
  obfuscation) and only writes+restarts the service when it differs.
- scripts/set-vnc-password.bat: set UltraVNC service VNC password as admin
  (createpassword/setpasswd + verify, GUI fallback). Manual fallback.
- internal/server/static/vnc.html: don't let the generic 'disconnect'
  banner overwrite the specific 'securityfailure' reason (noVNC's
  disconnect event has no reason field, so it always said 'unknown').
- AGENTS.md: document the above (scripts, run.bat, UltraVNC service note).

scripts/set-vnc-password.bat

@@ -0,0 +1,109 @@
+@echo off
+REM ============================================================
+REM  set-vnc-password.bat - reliably set the UltraVNC VNC password
+REM  for the running service (uvnc_service / LocalSystem), which
+REM  reads %ProgramData%\UltraVNC\ultravnc.ini.
+REM
+REM  Runs AS ADMINISTRATOR (auto-elevates). It first tries the
+REM  UltraVNC CLI helpers (createpassword.exe / setpasswd.exe) and
+REM  VERIFIES the password actually changed in ultravnc.ini; if they
+REM  fail silently (as they can), it opens the UltraVNC settings GUI
+REM  so you can set "VNC Password" there. Then it restarts the
+REM  service. Use the SAME password in run.bat (ASCII, max 8 chars).
+REM ============================================================
+chcp 866 >nul
+cd /d "%~dp0"
+
+net session >nul 2>nul
+if errorlevel 1 (
+  echo Requesting administrator rights ...
+  powershell -Command "Start-Process -FilePath '%~f0' -Verb RunAs"
+  exit /b
+)
+
+set "UVNC="
+for %%P in (
+  "C:\Program Files\uvnc bvba\UltraVNC"
+  "C:\Program Files\UltraVNC"
+  "C:\Program Files (x86)\uvnc bvba\UltraVNC"
+  "C:\Program Files (x86)\UltraVNC"
+) do (
+  if exist "%%~P\winvnc.exe" if not defined UVNC set "UVNC=%%~P"
+)
+if not defined UVNC (
+  echo [error] UltraVNC installation not found.
+  pause
+  exit /b 1
+)
+echo UltraVNC: %UVNC%
+set "INI=%ProgramData%\UltraVNC\ultravnc.ini"
+
+:getpw
+set "PW="
+set /p "PW=Enter VNC password (ASCII, max 8 chars): "
+if "%PW%"=="" ( echo Password cannot be empty. & goto getpw )
+
+REM record old passwd
+set "OLDPW="
+if exist "%INI%" for /f "tokens=2 delims==" %%a in ('findstr /b /i "passwd=" "%INI%" 2^>nul ^| findstr /v /i "passwd2"') do set "OLDPW=%%a"
+echo Old passwd=%OLDPW%
+
+REM try CLI helpers, verify after each
+set "DONE=0"
+if exist "%UVNC%\createpassword.exe" (
+  echo Trying createpassword.exe ...
+  "%UVNC%\createpassword.exe" "%PW%" >nul 2>nul
+  call :checkchanged
+)
+if "%DONE%"=="0" if exist "%UVNC%\setpasswd.exe" (
+  echo Trying setpasswd.exe ...
+  "%UVNC%\setpasswd.exe" "%PW%" "%PW%" >nul 2>nul
+  call :checkchanged
+)
+if "%DONE%"=="0" (
+  echo.
+  echo CLI helpers did not change the password file. Opening UltraVNC settings...
+  echo  -> right-click the UltraVNC tray icon, choose Admin Properties,
+  echo     set the "VNC Password" to: %PW%
+  echo  -> close the settings/tray app, then come back here and press a key.
+  echo.
+  start "" "%UVNC%\winvnc.exe"
+  pause
+  call :checkchanged
+)
+set "PW="
+if "%DONE%"=="0" (
+  echo [warn] Password still not changed in %INI%.
+  echo        Set it manually in UltraVNC Admin Properties as administrator.
+  pause
+  exit /b 1
+)
+
+REM restart the service so it reloads the password
+set "SVC=uvnc_service"
+sc query %SVC% >nul 2>nul
+if errorlevel 1 (
+  echo [warn] Service '%SVC%' not found; restart winvnc manually if it runs in app mode.
+  goto showini
+)
+echo Restarting service %SVC% ...
+net stop %SVC% >nul 2>nul
+net start %SVC%
+
+:showini
+echo.
+echo --- %INI% ---
+if exist "%INI%" type "%INI%"
+echo.
+echo Done. Use the SAME password in run.bat, then reconnect in the browser.
+pause
+exit /b
+
+:checkchanged
+set "NEWPW="
+if exist "%INI%" for /f "tokens=2 delims==" %%a in ('findstr /b /i "passwd=" "%INI%" 2^>nul ^| findstr /v /i "passwd2"') do set "NEWPW=%%a"
+if not "%NEWPW%"=="%OLDPW%" (
+  echo Password file updated. New passwd=%NEWPW%
+  set "DONE=1"
+)
+goto :eof