feat: web-vnc single-binary browser VNC gateway with password access

- Go stdlib-only gateway: serves noVNC client, password auth, WS<->TCP relay
- auth: PBKDF2-HMAC-SHA256 password hash, HMAC session cookies, login rate limit
- relay: hand-written RFC 6455 WebSocket + transparent RFB bridge
- vncspawner: cross-OS VNC server detection/launch (Windows/Linux/macOS)
- server: /login /logout /vnc /api/status routes, session middleware, embed.FS
- scripts: get-novnc, get-vnc (zip-verified), list-ips, open-firewall
- run.bat: one-click launcher (asks only password), lists access IPs
- README/AGENTS.md (Russian), .gitignore (root-anchored binaries)

scripts/get-novnc.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# get-novnc.sh
+# Downloads the noVNC web client and installs its assets into the embedded
+# static directory so they get baked into the single web-vnc binary.
+#
+# Usage (from repo root):  ./scripts/get-novnc.sh [version]
+set -euo pipefail
+VERSION="${1:-v1.4.0}"
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+STATIC_DIR="$REPO_ROOT/internal/server/static"
+mkdir -p "$STATIC_DIR"
+
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+
+URL="https://github.com/novnc/noVNC/archive/refs/tags/$VERSION.tar.gz"
+echo "Downloading noVNC $VERSION from $URL"
+curl -fL "$URL" -o "$WORK/novnc.tar.gz"
+
+echo "Extracting..."
+tar -xzf "$WORK/novnc.tar.gz" -C "$WORK"
+EXTRACTED="$(find "$WORK" -maxdepth 1 -type d -name 'noVNC-*' | head -n1)"
+[ -z "$EXTRACTED" ] && { echo "Extraction produced no noVNC-* directory"; exit 1; }
+
+for sub in core app vendor utils; do
+  [ -d "$EXTRACTED/$sub" ] || continue
+  cp -R "$EXTRACTED/$sub" "$STATIC_DIR/"
+  echo "  installed $sub/"
+done
+[ -f "$EXTRACTED/vnc.html" ] && cp "$EXTRACTED/vnc.html" "$STATIC_DIR/novnc-original.html" && echo "  copied noVNC vnc.html -> novnc-original.html (our vnc.html stays)"
+echo "Done. Rebuild web-vnc to embed the new client:  go build -o web-vnc ./cmd/web-vnc"