feat: autostart as a service + separate password setup (set-password.bat)

- set-password.bat: one-time password setup -> writes webvnc.conf (HASH + VNC_PASSWORD), syncs UltraVNC via ensure-vnc-password.ps1; if the 'web-vnc' task is installed, restarts it (elevated) to reload the new password, skipping restart when the password is unchanged.
- run.bat: no longer prompts for the password; reads it from webvnc.conf (asks to run set-password.bat first if absent). Also clears --spawn-command (not just --spawn) when 5900 is already listening, to avoid spawning a 2nd VNC server.
- scripts/autostart-run.bat: non-interactive launcher for the scheduled task (reads webvnc.conf, finds only a LOCAL VNC server, never downloads at boot).
- scripts/install-autostart.bat / uninstall-autostart.bat: register/remove a 'web-vnc' scheduled task (ONSTART, SYSTEM, HIGHEST) via schtasks.
- scripts/restart-autostart.bat: restart the task to apply a new password; checks whether web-vnc.exe is running (stop+start, or just start).
- .gitignore: ignore webvnc.conf (secret).
- AGENTS.md / README.md: document the autostart flow, set-password.bat, the new scripts, and that the running gateway must be restarted to apply a password change.

scripts/restart-autostart.bat

@@ -0,0 +1,58 @@
+@echo off
+REM ============================================================
+REM  restart-autostart.bat - restart the "web-vnc" task so the
+REM  running gateway reloads webvnc.conf (e.g. after set-password.bat
+REM  changed the password). web-vnc.exe reads the hash and the VNC
+REM  password only once at startup, so a restart is the only way to
+REM  apply a new password to the live gateway.
+REM
+REM  It first checks whether web-vnc.exe is actually running:
+REM    - running  -> stop the task (schtasks /End) and start it again;
+REM    - not running -> just start it (no /End).
+REM  Requires administrator rights (the task runs as SYSTEM), so it
+REM  auto-elevates. Called from set-password.bat, or run manually.
+REM ============================================================
+cd /d "%~dp0"
+
+net session >nul 2>nul
+if errorlevel 1 (
+  echo Requesting administrator rights ...
+  powershell -Command "Start-Process -FilePath '%~f0' -Verb RunAs"
+  exit /b
+)
+
+set "TASK=web-vnc"
+
+schtasks /Query /TN "%TASK%" >nul 2>nul
+if errorlevel 1 (
+  echo [error] Task "%TASK%" is not installed. Run scripts\install-autostart.bat first.
+  pause
+  exit /b 1
+)
+
+REM --- Is web-vnc.exe currently running? ---
+set "RUNNING=0"
+tasklist /FI "IMAGENAME eq web-vnc.exe" 2>nul | findstr /I /B /C:"web-vnc.exe" >nul
+if not errorlevel 1 set "RUNNING=1"
+
+if "%RUNNING%"=="1" (
+  echo web-vnc.exe is running - restarting task "%TASK%" ...
+  schtasks /End /TN "%TASK%" >nul 2>nul
+  REM give the previous process a moment to release port 8080
+  timeout /t 2 /nobreak >nul
+) else (
+  echo web-vnc.exe is NOT running - just starting task "%TASK%" ...
+)
+
+schtasks /Run /TN "%TASK%"
+if errorlevel 1 (
+  echo [error] Could not start the task.
+  pause
+  exit /b 1
+)
+
+echo.
+echo Done. web-vnc reloaded the password from webvnc.conf.
+echo Check it at http://localhost:8080
+echo.
+pause