feat: web-vnc single-binary browser VNC gateway with password access

- Go stdlib-only gateway: serves noVNC client, password auth, WS<->TCP relay
- auth: PBKDF2-HMAC-SHA256 password hash, HMAC session cookies, login rate limit
- relay: hand-written RFC 6455 WebSocket + transparent RFB bridge
- vncspawner: cross-OS VNC server detection/launch (Windows/Linux/macOS)
- server: /login /logout /vnc /api/status routes, session middleware, embed.FS
- scripts: get-novnc, get-vnc (zip-verified), list-ips, open-firewall
- run.bat: one-click launcher (asks only password), lists access IPs
- README/AGENTS.md (Russian), .gitignore (root-anchored binaries)

internal/vncspawner/detect_linux.go

@@ -0,0 +1,22 @@
+//go:build linux || freebsd
+
+package vncspawner
+
+import (
+	"os/exec"
+)
+
+// detectLinux finds x11vnc or TigerVNC on PATH.
+func candidates() []Candidate {
+	var cands []Candidate
+	if p, err := exec.LookPath("x11vnc"); err == nil {
+		cands = append(cands, Candidate{Path: p, Args: []string{"-display", ":0", "-nopw", "-localhost"}, Desc: "x11vnc"})
+	}
+	if p, err := exec.LookPath("tigervncserver"); err == nil {
+		cands = append(cands, Candidate{Path: p, Args: []string{":1", "-localhost", "-SecurityTypes", "None"}, Desc: "TigerVNC"})
+	}
+	if p, err := exec.LookPath("Xvnc"); err == nil {
+		cands = append(cands, Candidate{Path: p, Args: []string{":1", "-SecurityTypes", "None"}, Desc: "TigerVNC Xvnc"})
+	}
+	return cands
+}