feat: web-vnc single-binary browser VNC gateway with password access

- Go stdlib-only gateway: serves noVNC client, password auth, WS<->TCP relay
- auth: PBKDF2-HMAC-SHA256 password hash, HMAC session cookies, login rate limit
- relay: hand-written RFC 6455 WebSocket + transparent RFB bridge
- vncspawner: cross-OS VNC server detection/launch (Windows/Linux/macOS)
- server: /login /logout /vnc /api/status routes, session middleware, embed.FS
- scripts: get-novnc, get-vnc (zip-verified), list-ips, open-firewall
- run.bat: one-click launcher (asks only password), lists access IPs
- README/AGENTS.md (Russian), .gitignore (root-anchored binaries)

.gitignore

@@ -0,0 +1,34 @@
+# Build artifacts (root-anchored so they don't match the cmd/web-vnc package dir)
+/web-vnc
+/web-vnc.exe
+/web-vnc-linux
+/web-vnc-macos
+*.exe
+dist/
+
+# Go
+/vendor/
+.gocache/
+*.test
+
+# Local config / secrets
+*.local.yaml
+.env
+
+# Logs
+*.log
+*.err
+
+# OS
+Thumbs.db
+.DS_Store
+
+# Downloaded noVNC assets (installed via scripts/get-novnc.*)
+internal/server/static/core/
+internal/server/static/app/
+internal/server/static/vendor/
+internal/server/static/utils/
+internal/server/static/novnc-original.html
+
+# Downloaded VNC server (installed via scripts/get-vnc.ps1)
+/vnc/