feat: web-vnc single-binary browser VNC gateway with password access

- Go stdlib-only gateway: serves noVNC client, password auth, WS<->TCP relay
- auth: PBKDF2-HMAC-SHA256 password hash, HMAC session cookies, login rate limit
- relay: hand-written RFC 6455 WebSocket + transparent RFB bridge
- vncspawner: cross-OS VNC server detection/launch (Windows/Linux/macOS)
- server: /login /logout /vnc /api/status routes, session middleware, embed.FS
- scripts: get-novnc, get-vnc (zip-verified), list-ips, open-firewall
- run.bat: one-click launcher (asks only password), lists access IPs
- README/AGENTS.md (Russian), .gitignore (root-anchored binaries)

scripts/open-firewall.bat

@@ -0,0 +1,37 @@
+@echo off
+REM ============================================================
+REM  open-firewall.bat - ®âªà뢠¥â ¯®àâ 8080 ¢ Windows Firewall.
+REM  ‡ ¯ã᪠âì ®â ¨¬¥­¨  ¤¬¨­¨áâà â®à  (®¤¨­ à §).
+REM  ‹¨¡® § ¯ãáâ¨â¥ ¤¢ ¦¤ë: ä ©« á ¬ § ¯à®á¨â ¯à ¢   ¤¬¨­¨áâà â®à .
+REM ============================================================
+chcp 866 >nul
+cd /d "%~dp0"
+
+REM �஢¥àª  ¯à ¢  ¤¬¨­¨áâà â®à  ¨  ¢â®-¯®¢ë襭¨¥.
+net session >nul 2>nul
+if errorlevel 1 (
+  echo ‡ ¯à®á ¯à ¢  ¤¬¨­¨áâà â®à  ...
+  powershell -Command "Start-Process -FilePath '%~f0' -Verb RunAs"
+  exit /b
+)
+
+set PORT=8080
+set RULE=web-vnc
+
+echo “¤ «ïî áâ à®¥ ¯à ¢¨«® (¥á«¨ ¥áâì) ...
+netsh advfirewall firewall delete rule name="%RULE%" >nul 2>nul
+
+echo „®¡ ¢«ïî à §à¥è î饥 ¯à ¢¨«® ¤«ï ¢å®¤ï饣® TCP-âà ä¨ª  ­  ¯®àâ %PORT% ...
+netsh advfirewall firewall add rule name="%RULE%" dir=in action=allow protocol=TCP localport=%PORT%
+if errorlevel 1 (
+  echo [®è¨¡ª ] �¥ 㤠«®áì ¤®¡ ¢¨âì ¯à ¢¨«®.
+  pause
+  exit /b 1
+)
+
+echo.
+echo ƒ®â®¢®. �®àâ %PORT% ®âªàëâ ¤«ï ¢å®¤ïé¨å ¯®¤ª«î祭¨©.
+echo ’¥¯¥àì ª web-vnc ¬®¦­® ¯®¤ª«îç âìáï á ¤àã£¨å ¬ è¨­ á¥â¨ ¯®  ¤à¥áã:
+echo   http://IP_�’Ž‰_Œ€˜ˆ�›:%PORT%
+echo.
+pause