fix /desktop: break the VNC password deadlock, drop the vncpasswd dependency

The desktop page has never worked on a fresh install. Two faults, both fatal.

The password could never be created. DesktopView fetches /desktop/vnc-password
before opening the WebSocket, but ensureVncPassword ran only from startSession,
which only the WebSocket triggers — so the endpoint answered "not configured",
the UI stopped, and the socket that would have provisioned it was never opened.
A new vnc:ensure-password sidecar command provisions it directly; the endpoint
asks for it instead of returning 500.

The rfbauth file could never be written either. ensureVncPassword shelled out to
tigervnc's `vncpasswd -f`, which is not installed — and, contrary to the comment
in setup-desktop.sh, is not in tigervnc-common, which ships only tigervncconfig.
The failure was swallowed because only a zero exit wrote the file, so x11vnc got
-rfbauth pointing at nothing. x11vnc writes that format itself with -storepasswd,
so the dependency is gone and a failure now throws.

Verified on the box: the endpoint returns a password, .vnc/{passwd,password} are
written 0600, and the sidecar reports mirroring :0 on 5900 with x11vnc using the
generated rfbauth file.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/api/desktop/rest.ts

@@ -4,13 +4,28 @@ import * as sidecar from '@@/sidecar-registry';
 
 export const desktopRouter = createRouter();
 
+// The desktop UI asks for the password before it can open the WebSocket — and that WebSocket is what
+// starts the VNC session. So this cannot wait for a session to exist: on a fresh install nothing has
+// ever written the password, and answering "not configured" deadlocked the page permanently. Ask the
+// sidecar to provision it instead; it owns the .vnc directory and the call is idempotent.
 desktopRouter.get('/vnc-password', async (ctx) => {
   const user = ctx.get('user');
-  const password = await getVncPassword(user.email);
-  if (!password) {
-    return ctx.json({ error: 'VNC password not configured' }, 500);
+
+  const existing = await getVncPassword(user.email);
+  if (existing) return ctx.json({ password: existing });
+
+  if (!sidecar.isVncConnected()) {
+    return ctx.json({ error: 'VNC sidecar is not connected' }, 503);
+  }
+
+  try {
+    const password = await sidecar.ensureVncPassword(user.email);
+    return ctx.json({ password });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : 'Could not provision the VNC password';
+    console.error('[desktop] VNC password provisioning failed:', message);
+    return ctx.json({ error: message }, 500);
   }
-  return ctx.json({ password });
 });
 
 desktopRouter.get('/vnc-status', async (ctx) => {