feat: self-hosted remote support over VNC

Browser-based remote control (noVNC) with invite links, per-user access
control, garagedoor SSO and a persisted client list.

The hub proxies RFB rather than pointing the browser at a VNC server. That
is what lets it authenticate upstream with a stored password the browser
never sees, and enforce view-only by dropping input messages on the
client->server stream instead of hiding buttons.

Machines are reachable two ways: direct TCP for LAN hosts, or an outbound
agent tunnel for anything behind NAT. Node 22's global WebSocket keeps the
agent dependency-free, and node:sqlite keeps the image free of native
builds.

Ships with an end-to-end suite that boots the real server against a fake
VNC server and a fake auth service (72 assertions), plus Gitea Actions
CI/CD to Portainer.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.env.example

@@ -0,0 +1,32 @@
+# HTTP listener
+PORT=8080
+HOST=0.0.0.0
+
+# Central auth (garagedoor-node-ws)
+AUTH_URL=http://192.168.4.208:8000
+
+# Who counts as an admin. Leave BOTH unset and every authenticated user is an
+# admin — fine for a single operator, not for a shared install.
+ADMIN_USERS=rmancinas
+# ADMIN_LEVEL=10
+
+# Where the SQLite database lives (the encryption key is written next to it)
+DB_PATH=/data/rcs.db
+
+# 32+ random chars. Encrypts stored VNC passwords. Generate with:
+#   node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
+# If unset, one is generated next to the database on first boot.
+ENCRYPTION_KEY=
+
+# Base URL used when rendering invite links. Set this once it is behind a proxy.
+PUBLIC_URL=https://remote.mancinas.dev
+
+# Turn off to disable no-login support links entirely
+ALLOW_SESSION_INVITES=true
+
+# Tuning
+TICKET_TTL_MS=30000
+INVITE_TTL_MS=86400000
+CONSENT_TIMEOUT_MS=45000
+AGENT_OFFLINE_AFTER_MS=90000
+TRUST_PROXY=true