feat: web-vnc single-binary browser VNC gateway with password access

- Go stdlib-only gateway: serves noVNC client, password auth, WS<->TCP relay
- auth: PBKDF2-HMAC-SHA256 password hash, HMAC session cookies, login rate limit
- relay: hand-written RFC 6455 WebSocket + transparent RFB bridge
- vncspawner: cross-OS VNC server detection/launch (Windows/Linux/macOS)
- server: /login /logout /vnc /api/status routes, session middleware, embed.FS
- scripts: get-novnc, get-vnc (zip-verified), list-ips, open-firewall
- run.bat: one-click launcher (asks only password), lists access IPs
- README/AGENTS.md (Russian), .gitignore (root-anchored binaries)

scripts/get-novnc.ps1

@@ -0,0 +1,46 @@
+# get-novnc.ps1
+# Downloads the noVNC web client and installs its assets into the embedded
+# static directory so they get baked into the single web-vnc binary.
+#
+# Usage (from repo root):  .\scripts\get-novnc.ps1
+# Optionally pass a version: .\scripts\get-novnc.ps1 -Version v1.4.0
+param(
+  [string]$Version = "v1.4.0"
+)
+
+$ErrorActionPreference = "Stop"
+$repoRoot = Resolve-Path (Join-Path $PSScriptRoot "..")
+$staticDir = Join-Path $repoRoot "internal\server\static"
+New-Item -ItemType Directory -Force -Path $staticDir | Out-Null
+
+$work = Join-Path $env:TEMP "webvnc-novnc-$([guid]::NewGuid())"
+New-Item -ItemType Directory -Force -Path $work | Out-Null
+try {
+  $archive = Join-Path $work "novnc.tar.gz"
+  $url = "https://github.com/novnc/noVNC/archive/refs/tags/$Version.tar.gz"
+  Write-Host "Downloading noVNC $Version from $url"
+  Invoke-WebRequest -Uri $url -OutFile $archive -UseBasicParsing
+
+  Write-Host "Extracting..."
+  tar -xzf $archive -C $work
+  $extracted = Get-ChildItem -Directory -Path $work | Where-Object { $_.Name -like "noVNC-*" } | Select-Object -First 1
+  if (-not $extracted) { throw "Extraction produced no noVNC-* directory" }
+
+  # Copy noVNC assets, but keep our custom vnc.html wrapper intact.
+  foreach ($sub in @("core","app","vendor","utils")) {
+    $src = Join-Path $extracted.FullName $sub
+    if (Test-Path $src) {
+      Copy-Item -Path $src -Destination $staticDir -Recurse -Force
+      Write-Host "  installed $sub/"
+    }
+  }
+  # Optionally keep noVNC's own page under a different name for reference.
+  if (Test-Path (Join-Path $extracted.FullName "vnc.html")) {
+    Copy-Item -Path (Join-Path $extracted.FullName "vnc.html") -Destination (Join-Path $staticDir "novnc-original.html") -Force
+    Write-Host "  copied noVNC vnc.html -> novnc-original.html (our vnc.html stays)"
+  }
+  Write-Host "Done. Rebuild web-vnc to embed the new client:  go build -o web-vnc.exe .\cmd\web-vnc"
+}
+finally {
+  Remove-Item -Path $work -Recurse -Force -ErrorAction SilentlyContinue
+}