feat: harden console sessions + complete protocol support

- single-use session tokens (atomic ConsumeSessionToken) + user-bound tunnel (actor must match session opener)
- wire VNC end-to-end (stash/consume password, connect+tunnel, frontend password field)
- passphrase-protected SSH keys: passphrase_enc on Key model, capture on upload, decrypt + pass to guacd

deploy/docker-compose.yml

@@ -23,7 +23,7 @@ services:
       retries: 5
 
   guacd:
-    image: guacamole/guacd:1.5.5
+    image: guacamole/guacd:1.6
     restart: unless-stopped
 
   server: