feat: harden console sessions + complete protocol support

- single-use session tokens (atomic ConsumeSessionToken) + user-bound tunnel (actor must match session opener)
- wire VNC end-to-end (stash/consume password, connect+tunnel, frontend password field)
- passphrase-protected SSH keys: passphrase_enc on Key model, capture on upload, decrypt + pass to guacd

web/app/servers/[id]/console/page.tsx

@@ -22,6 +22,7 @@ export default function ServerConsolePage() {
     const [sshUsername, setSshUsername] = useState<string>("root");
     const [rdpUsername, setRdpUsername] = useState("");
     const [rdpPassword, setRdpPassword] = useState("");
+    const [vncPassword, setVncPassword] = useState("");
     const [connecting, setConnecting] = useState(false);
     const [connected, setConnected] = useState(false);
     const [error, setError] = useState<string | null>(null);
@@ -77,6 +78,8 @@ export default function ServerConsolePage() {
             } else if (protocol === "rdp") {
                 body.rdp_username = rdpUsername || undefined;
                 body.rdp_password = rdpPassword || undefined;
+            } else if (protocol === "vnc") {
+                body.rdp_password = vncPassword || undefined;
             }
 
             const { token, ws_path } = await api.connectConsole(body);
@@ -205,6 +208,19 @@ export default function ServerConsolePage() {
                             </>
                         )}
 
+                        {protocol === "vnc" && (
+                            <div>
+                                <label className="mb-1.5 block text-sm font-medium text-text-secondary">Password</label>
+                                <input
+                                    type="password"
+                                    value={vncPassword}
+                                    onChange={(e) => setVncPassword(e.target.value)}
+                                    autoComplete="new-password"
+                                    className="w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30"
+                                />
+                            </div>
+                        )}
+
                         <Button variant="primary" loading={connecting} disabled={!protocol} onClick={handleConnect}>
                             Connect
                         </Button>