feat: autostart as a service + separate password setup (set-password.bat)

- set-password.bat: one-time password setup -> writes webvnc.conf (HASH + VNC_PASSWORD), syncs UltraVNC via ensure-vnc-password.ps1; if the 'web-vnc' task is installed, restarts it (elevated) to reload the new password, skipping restart when the password is unchanged.
- run.bat: no longer prompts for the password; reads it from webvnc.conf (asks to run set-password.bat first if absent). Also clears --spawn-command (not just --spawn) when 5900 is already listening, to avoid spawning a 2nd VNC server.
- scripts/autostart-run.bat: non-interactive launcher for the scheduled task (reads webvnc.conf, finds only a LOCAL VNC server, never downloads at boot).
- scripts/install-autostart.bat / uninstall-autostart.bat: register/remove a 'web-vnc' scheduled task (ONSTART, SYSTEM, HIGHEST) via schtasks.
- scripts/restart-autostart.bat: restart the task to apply a new password; checks whether web-vnc.exe is running (stop+start, or just start).
- .gitignore: ignore webvnc.conf (secret).
- AGENTS.md / README.md: document the autostart flow, set-password.bat, the new scripts, and that the running gateway must be restarted to apply a password change.

scripts/autostart-run.bat

@@ -0,0 +1,52 @@
+@echo off
+REM ============================================================
+REM  autostart-run.bat - non-interactive launcher used by the
+REM  scheduled task created by install-autostart.bat.
+REM  Reads the password from webvnc.conf, finds a LOCAL VNC server
+REM  (does NOT download anything), and starts web-vnc.exe in the
+REM  foreground. The task keeps the process alive and restarts it
+REM  on next boot.
+REM  Exit codes: 0 = server ran and stopped; 1 = no binary;
+REM              2 = password not configured; other = web-vnc error.
+REM ============================================================
+cd /d "%~dp0"
+
+REM --- 1. Binary (build if Go is available, else fail) ---
+if not exist "web-vnc.exe" (
+  where go >nul 2>nul
+  if not errorlevel 1 (
+    go build -o web-vnc.exe .\cmd\web-vnc >nul 2>nul
+  )
+)
+if not exist "web-vnc.exe" exit /b 1
+
+REM --- 2. Stored password ---
+if not exist "webvnc.conf" exit /b 2
+set "HASH="
+set "VNC_PW="
+for /f "tokens=1,* delims==" %%a in (webvnc.conf) do (
+  if /i "%%a"=="HASH" set "HASH=%%b"
+  if /i "%%a"=="VNC_PASSWORD" set "VNC_PW=%%b"
+)
+if "%HASH%"=="" exit /b 2
+if "%VNC_PW%"=="" exit /b 2
+set "WEBVNC_VNC_PASSWORD=%VNC_PW%"
+set "VNC_PW="
+
+REM --- 3. VNC server (detect local only; never download at boot) ---
+set "SPAWNARGS="
+set "SPAWN_CMD="
+if exist "vnc\winvnc.exe" set "SPAWN_CMD=vnc\winvnc.exe -run"
+if exist "vnc\tvnserver.exe" if not defined SPAWN_CMD set "SPAWN_CMD=vnc\tvnserver.exe -run"
+if defined SPAWN_CMD set "SPAWNARGS=--spawn-command "%SPAWN_CMD%""
+
+set "SPAWNFLAG=--spawn"
+powershell -NoProfile -Command "try{$c=New-Object Net.Sockets.TcpClient('127.0.0.1',5900);$c.Close();exit 0}catch{exit 1}"
+if not errorlevel 1 (
+  set "SPAWNFLAG="
+  set "SPAWNARGS="
+)
+
+REM --- 4. Launch (foreground; the task host keeps it alive) ---
+web-vnc.exe --password-hash "%HASH%" %SPAWNARGS% %SPAWNFLAG% --listen :8080
+exit /b %errorlevel%