vnc sidecar: per-user desktop sessions via sidecar architecture

replaces the single hardcoded systemd VNC service with a dynamic
sidecar that manages per-user VNC sessions on demand. any authenticated
user can now access their own desktop, not just Super Admin.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

scripts/provision-existing-users.sh

@@ -160,6 +160,29 @@ while IFS='|' read -r email username; do
   sudo mkdir -p "$HOME_DIR/.local/bin"
   sudo mkdir -p "$HOME_DIR/.pi/agent/sessions"
 
+  # VNC environment
+  VNC_DIR="$HOME_DIR/.vnc"
+  sudo mkdir -p "$VNC_DIR"
+  if [ ! -f "$VNC_DIR/passwd" ]; then
+    VNC_PASS=$(head -c 32 /dev/urandom | base64 | tr -dc 'a-zA-Z0-9' | head -c 8)
+    echo -n "$VNC_PASS" | sudo tee "$VNC_DIR/password" > /dev/null
+    echo -n "$VNC_PASS" | vncpasswd -f | sudo tee "$VNC_DIR/passwd" > /dev/null
+    sudo tee "$VNC_DIR/xstartup" > /dev/null << 'XSTARTUP'
+#!/bin/sh
+unset SESSION_MANAGER
+unset DBUS_SESSION_BUS_ADDRESS
+eval $(dbus-launch --sh-syntax)
+export DBUS_SESSION_BUS_ADDRESS
+exec startxfce4
+XSTARTUP
+    sudo chmod +x "$VNC_DIR/xstartup"
+    sudo chmod 600 "$VNC_DIR/passwd"
+    sudo chmod 600 "$VNC_DIR/password"
+    ok "Provisioned VNC environment"
+  else
+    skip "VNC environment"
+  fi
+
   # Set ownership and permissions last
   # chmod 770 so only owner and group can access (service user is added to group above)
   sudo chown -R "$shell_user:$shell_user" "$USER_ROOT"