fix /desktop: break the VNC password deadlock, drop the vncpasswd dependency

The desktop page has never worked on a fresh install. Two faults, both fatal.

The password could never be created. DesktopView fetches /desktop/vnc-password
before opening the WebSocket, but ensureVncPassword ran only from startSession,
which only the WebSocket triggers — so the endpoint answered "not configured",
the UI stopped, and the socket that would have provisioned it was never opened.
A new vnc:ensure-password sidecar command provisions it directly; the endpoint
asks for it instead of returning 500.

The rfbauth file could never be written either. ensureVncPassword shelled out to
tigervnc's `vncpasswd -f`, which is not installed — and, contrary to the comment
in setup-desktop.sh, is not in tigervnc-common, which ships only tigervncconfig.
The failure was swallowed because only a zero exit wrote the file, so x11vnc got
-rfbauth pointing at nothing. x11vnc writes that format itself with -storepasswd,
so the dependency is gone and a failure now throws.

Verified on the box: the endpoint returns a password, .vnc/{passwd,password} are
written 0600, and the sidecar reports mirroring :0 on 5900 with x11vnc using the
generated rfbauth file.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/sidecar/protocol.ts

@@ -21,6 +21,8 @@ export type SidecarCommand =
   | { type: 'opencode:kill'; id: string; sessionKey: string }
   // VNC
   | { type: 'vnc:start'; id: string; params: VncStartParams }
+  // Provision the VNC password without starting a server — the UI needs it before it can connect
+  | { type: 'vnc:ensure-password'; id: string; email: string }
   | { type: 'vnc:stop'; id: string; email: string }
   | { type: 'vnc:status'; id: string; email: string };
 
@@ -39,6 +41,7 @@ export type SidecarEvent =
   | { type: 'claude:session-cleared'; id: string }
   // VNC
   | { type: 'vnc:started'; id: string; port: number; display: number }
+  | { type: 'vnc:password'; id: string; password: string }
   | { type: 'vnc:stopped'; id: string }
   | { type: 'vnc:status'; id: string; session: VncSessionInfo | null }
   | { type: 'vnc:error'; id: string; error: string }