feat: autostart as a service + separate password setup (set-password.bat)

- set-password.bat: one-time password setup -> writes webvnc.conf (HASH + VNC_PASSWORD), syncs UltraVNC via ensure-vnc-password.ps1; if the 'web-vnc' task is installed, restarts it (elevated) to reload the new password, skipping restart when the password is unchanged.
- run.bat: no longer prompts for the password; reads it from webvnc.conf (asks to run set-password.bat first if absent). Also clears --spawn-command (not just --spawn) when 5900 is already listening, to avoid spawning a 2nd VNC server.
- scripts/autostart-run.bat: non-interactive launcher for the scheduled task (reads webvnc.conf, finds only a LOCAL VNC server, never downloads at boot).
- scripts/install-autostart.bat / uninstall-autostart.bat: register/remove a 'web-vnc' scheduled task (ONSTART, SYSTEM, HIGHEST) via schtasks.
- scripts/restart-autostart.bat: restart the task to apply a new password; checks whether web-vnc.exe is running (stop+start, or just start).
- .gitignore: ignore webvnc.conf (secret).
- AGENTS.md / README.md: document the autostart flow, set-password.bat, the new scripts, and that the running gateway must be restarted to apply a password change.

run.bat

@@ -1,6 +1,9 @@
 @echo off
 REM ============================================================
-REM  web-vnc launcher - one-click start, asks only for the password.
+REM  web-vnc launcher - starts the gateway without prompting.
+REM  The password is set up once with set-password.bat (stored in
+REM  webvnc.conf). If webvnc.conf is missing, this script tells you
+REM  to run set-password.bat first.
 REM ============================================================
 cd /d "%~dp0"
 
@@ -70,31 +73,29 @@ echo Install UltraVNC/TightVNC manually or retry: scripts\get-vnc.ps1
 echo.
 :vncdone
 
-REM --- 4. Password ---
-:getpw
-set "PW="
-set /p "PW=Enter access password: "
-if "%PW%"=="" goto emptypw
-goto gotpw
-:emptypw
-echo Password cannot be empty.
-goto getpw
-:gotpw
-
-REM --- 4b. Sync UltraVNC password with the one entered (only when it differs) ---
-echo Syncing UltraVNC password with the one entered. It will ask for admin rights if they differ...
-powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0scripts\ensure-vnc-password.ps1" -Password "%PW%"
-if errorlevel 1 echo [warning] Could not sync the UltraVNC password - continuing.
-
-REM --- 5. Password hash + same password for the VNC server ---
-echo Generating password hash ...
-for /f "delims=" %%i in ('web-vnc.exe --gen-hash "%PW%"') do set "HASH=%%i"
-if "%HASH%"=="" goto hashfail
+REM --- 4. Stored password (set up once via set-password.bat) ---
+if not exist "webvnc.conf" goto nopwconf
+set "HASH="
+set "VNC_PW="
+for /f "tokens=1,* delims==" %%a in (webvnc.conf) do (
+  if /i "%%a"=="HASH" set "HASH=%%b"
+  if /i "%%a"=="VNC_PASSWORD" set "VNC_PW=%%b"
+)
+if "%HASH%"=="" goto nopwconf
+if "%VNC_PW%"=="" goto nopwconf
 REM The same password is auto-sent to noVNC to authenticate against the VNC server.
-set "WEBVNC_VNC_PASSWORD=%PW%"
-set "PW="
+set "WEBVNC_VNC_PASSWORD=%VNC_PW%"
+set "VNC_PW="
+goto havepw
+:nopwconf
+echo [error] Password is not configured yet.
+echo Run set-password.bat once to set the password, then start run.bat.
+echo.
+pause
+exit /b 1
+:havepw
 
-REM --- 6. Available addresses ---
+REM --- 5. Available addresses ---
 echo.
 echo === Addresses to connect to (port 8080) ===
 echo   http://localhost:8080
@@ -104,7 +105,7 @@ echo If it does not open from another machine, run once as administrator:
 echo   scripts\open-firewall.bat
 echo.
 
-REM --- 7. Launch ---
+REM --- 6. Launch ---
 echo Starting web-vnc on http://localhost:8080
 echo Stop: Ctrl+C
 echo.
@@ -114,6 +115,7 @@ powershell -NoProfile -Command "try{$c=New-Object Net.Sockets.TcpClient('127.0.0
 if not errorlevel 1 (
   echo VNC server already listening on 127.0.0.1:5900 - connecting to it without --spawn.
   set "SPAWNFLAG="
+  set "SPAWNARGS="
 )
 web-vnc.exe --password-hash "%HASH%" %SPAWNARGS% %SPAWNFLAG% --listen :8080
 echo.
@@ -124,9 +126,4 @@ exit /b
 :buildfail
 echo Build failed.
 pause
-exit /b 1
-
-:hashfail
-echo [error] Could not generate the password hash.
-pause
 exit /b 1