fix: bound and complete console relay teardown, restore proxy_failed audit

- Arm the unclaimed-relay watchdog in NewSession rather than Serve, so an
  agent that never opens its ProxyStream is bounded to 10s and reports
  reason "agent_timeout", per the design spec's failure-mode table.
- Session.Close now also closes the accepted net.Conn (stored via setConn),
  so ConsoleProxy.Close() is an unconditional kill of the whole relay chain
  instead of only closing an already-idle listener.
- Emit console.proxy_failed and end the console session from a defer in
  consoleTunnel guarded on relay.Reason(), since guac's OnDisconnect never
  runs when the connect callback errors -- which is the path every relay
  failure this feature introduces takes. Update the two docsite
  troubleshooting rows to match what the audit event can now actually show.

docsite/docs/vantage/browser-console.md

@@ -70,4 +70,4 @@ keystroke log. If you need that, it has to come from the target machine.
 | Connects then closes immediately | guacd unreachable check `GUACD_ADDR` and that the container is up               |
 | SSH refuses the key              | The stored key has no private half, or is not in the target's `authorized_keys` |
 | RDP fails on a fresh credential  | Credentials are consumed on open; a retry needs them entered again              |
-| Hangs at connecting              | The agent is offline, or nothing is listening on the protocol port on the target's own loopback address. Check the audit log for `console.proxy_failed` — its reason names which |
+| Hangs, then disconnects           | The agent never claimed the relay, nothing is listening on the protocol port on the target's own loopback address, or guacd never dialled in time. Check the audit log for `console.proxy_failed` — its reason (`agent_timeout`, `dial_refused`, `guacd_timeout`, `rejected`) names which |