feat(agent): ship a Node 12 executable for Windows Server 2008 R2

Machines that cannot install Node 22 had no way to run the agent at all, which
left them stuck on direct mode — and direct mode only works when the hub can
route to the VNC port, which it often cannot.

agent.js now resolves the two Node 22 globals it uses through fallbacks: `ws`
for the control and tunnel sockets, and http/https for the single enrolment
POST. Node 22 loads neither, since `globalThis.WebSocket || require('ws')`
short-circuits. The require and the http/https references are static so the
bundler can follow them.

A new Docker stage bundles that file with a Node 12 runtime — the last line
supporting Windows 7 and Server 2008 R2 — into one self-contained .exe, served
from /download/agent.exe and linked from the enrolment page. The route answers
503 rather than 404 in a dev checkout, where the build has not run.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Dockerfile

@@ -1,3 +1,16 @@
+# Machines that cannot run Node 22 still need an agent. Windows Server 2008 R2
+# and Windows 7 top out at Node 13, so the same agent.js is bundled with a Node
+# 12 runtime into a single .exe the hub serves from /download/agent.exe.
+FROM node:22-alpine AS agent-exe
+WORKDIR /build
+COPY agent ./agent
+# `ws` stands in for the global WebSocket the old runtime does not have; pkg
+# follows the literal require in agent.js and bundles it.
+RUN npm install --no-save --no-audit --no-fund ws@8.18.0 \
+ && npx --yes pkg@5.8.1 agent/agent.js \
+      --targets node12-win-x64 \
+      --output dist/rcs-agent.exe
+
 FROM node:22-alpine
 
 # node:sqlite is built into Node 22, so there are no native modules to compile
@@ -15,6 +28,7 @@ RUN pnpm install --prod --frozen-lockfile
 COPY server ./server
 COPY public ./public
 COPY agent ./agent
+COPY --from=agent-exe /build/dist/rcs-agent.exe ./dist/rcs-agent.exe
 
 VOLUME ["/data"]
 EXPOSE 8080