feat: harden console sessions + complete protocol support

- single-use session tokens (atomic ConsumeSessionToken) + user-bound tunnel (actor must match session opener)
- wire VNC end-to-end (stash/consume password, connect+tunnel, frontend password field)
- passphrase-protected SSH keys: passphrase_enc on Key model, capture on upload, decrypt + pass to guacd

server/internal/models/console_session.go

@@ -17,6 +17,10 @@ type ConsoleSession struct {
 	EndedAt   *time.Time    `bson:"ended_at,omitempty" json:"ended_at,omitempty"`
 	ClientIP  string        `bson:"client_ip,omitempty" json:"client_ip,omitempty"`
 
+	// TokenConsumedAt marks the one-time session token as spent. Set atomically
+	// when the tunnel opens; a second open with the same token is rejected.
+	TokenConsumedAt *time.Time `bson:"token_consumed_at,omitempty" json:"-"`
+
 	SSHUsername string `bson:"ssh_username,omitempty" json:"ssh_username,omitempty"`
 
 	RDPUserEnc string `bson:"rdp_user_enc,omitempty" json:"-"`

server/internal/models/key.go

@@ -16,5 +16,7 @@ type Key struct {
 	GeneratedByServerID string        `bson:"generated_by_server_id,omitempty" json:"generated_by_server_id,omitempty"`
 	PrivateKeyEncrypted string        `bson:"private_key_enc,omitempty" json:"-"`
 	HasPrivateKey       bool          `bson:"-" json:"has_private_key"`
+	PassphraseEncrypted string        `bson:"passphrase_enc,omitempty" json:"-"`
+	HasPassphrase       bool          `bson:"-" json:"has_passphrase"`
 	CreatedAt           time.Time     `bson:"created_at" json:"created_at"`
 }