refactor: move user-facing scripts to repo root; fix set-password ordering

- install-autostart.bat, uninstall-autostart.bat, restart-autostart.bat,
  open-firewall.bat moved from scripts/ to the repo root (next to run.bat and
  set-password.bat). Internal helpers (autostart-run.bat, ensure-vnc-password.ps1,
  get-novnc.*, get-vnc.ps1, list-ips.ps1) stay in scripts/. autostart-run.bat is
  kept in scripts/ because the scheduled task /TR points at it; moving it would
  break already-installed tasks.
- Updated all references (set-password.bat, run.bat, install/restart-autostart.bat,
  AGENTS.md, README.md).
- set-password.bat: write webvnc.conf BEFORE the UltraVNC sync so the web password
  is configured even if ensure-vnc-password.ps1 fails / its UAC is dismissed
  (previously 'Password is not configured' from install-autostart.bat when the
  sync blocked before conf was written).
- AGENTS.md / README.md structure + autostart sections updated for the new layout.

open-firewall.bat

@@ -0,0 +1,36 @@
+@echo off
+REM ============================================================
+REM  open-firewall.bat - opens port 8080 in the Windows Firewall.
+REM  Run as administrator (once). Or just launch it: it will request
+REM  admin rights itself.
+REM ============================================================
+cd /d "%~dp0"
+
+REM Admin check + auto-elevate.
+net session >nul 2>nul
+if errorlevel 1 (
+  echo Requesting administrator rights ...
+  powershell -Command "Start-Process -FilePath '%~f0' -Verb RunAs"
+  exit /b
+)
+
+set PORT=8080
+set RULE=web-vnc
+
+echo Removing the old rule (if any) ...
+netsh advfirewall firewall delete rule name="%RULE%" >nul 2>nul
+
+echo Adding an allow rule for inbound TCP traffic on port %PORT% ...
+netsh advfirewall firewall add rule name="%RULE%" dir=in action=allow protocol=TCP localport=%PORT%
+if errorlevel 1 (
+  echo [error] Could not add the rule.
+  pause
+  exit /b 1
+)
+
+echo.
+echo Done. Port %PORT% is open for inbound connections.
+echo You can now connect to web-vnc from other machines on the network at:
+echo   http://THIS_MACHINE_IP:%PORT%
+echo.
+pause