feat: harden console sessions + complete protocol support

- single-use session tokens (atomic ConsumeSessionToken) + user-bound tunnel (actor must match session opener)
- wire VNC end-to-end (stash/consume password, connect+tunnel, frontend password field)
- passphrase-protected SSH keys: passphrase_enc on Key model, capture on upload, decrypt + pass to guacd

web/lib/api.ts

@@ -46,6 +46,7 @@ export interface Key {
   source: KeySource;
   generated_by_server_id?: string;
   has_private_key: boolean;
+  has_passphrase?: boolean;
   created_at: string;
   assigned_count?: number;
 }
@@ -278,10 +279,15 @@ export const api = {
     return request<KeyWithAssignments>(`/keys/${keyId}`);
   },
 
-  uploadKey(label: string, public_key: string, private_key?: string): Promise<Key> {
+  uploadKey(label: string, public_key: string, private_key?: string, passphrase?: string): Promise<Key> {
     return request<Key>("/keys", {
       method: "POST",
-      body: JSON.stringify({ label, public_key, private_key: private_key || undefined }),
+      body: JSON.stringify({
+        label,
+        public_key,
+        private_key: private_key || undefined,
+        passphrase: passphrase || undefined,
+      }),
     });
   },