vnc sidecar: per-user desktop sessions via sidecar architecture

replaces the single hardcoded systemd VNC service with a dynamic
sidecar that manages per-user VNC sessions on demand. any authenticated
user can now access their own desktop, not just Super Admin.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/servers/api/desktop/websocket.ts

@@ -1,6 +1,6 @@
 import type { ServerWebSocket } from 'bun';
 import type { Socket } from 'bun';
-import { getVncPort } from './vnc-config';
+import * as sidecar from '@@/sidecar-registry';
 
 type WSData = { userId: number; email: string; username: string; role: string; sandboxed: boolean; sessionId?: string };
 
@@ -13,15 +13,25 @@ const sessions = new Map<ServerWebSocket<WSData>, VncSession>();
 
 export const desktopWebsocket = {
   async open(ws: ServerWebSocket<WSData>) {
-    if (ws.data.role !== 'Super Admin') {
-      ws.close(4003, 'Forbidden');
-      return;
-    }
-
-    const port = await getVncPort(ws.data.email, ws.data.role);
     const session: VncSession = { tcpSocket: null, pendingMessages: [] };
     sessions.set(ws, session);
 
+    let port: number;
+    try {
+      const result = await sidecar.startVnc({
+        email: ws.data.email,
+        username: ws.data.username,
+        role: ws.data.role,
+      });
+      port = result.port;
+    } catch (err) {
+      const message = err instanceof Error ? err.message : 'Failed to start VNC session';
+      console.error('[desktop] VNC start failed:', message);
+      sessions.delete(ws);
+      ws.close(4004, 'VNC server unavailable');
+      return;
+    }
+
     try {
       const tcpSocket = await Bun.connect({
         hostname: '127.0.0.1',
@@ -36,20 +46,31 @@ export const desktopWebsocket = {
           },
           close() {
             sessions.delete(ws);
-            try { ws.close(); } catch { /* ignore */ }
+            try {
+              ws.close();
+            } catch {
+              /* ignore */
+            }
           },
           error(_socket, err) {
             console.error('[desktop] TCP error:', err.message);
             sessions.delete(ws);
-            try { ws.close(); } catch { /* ignore */ }
+            try {
+              ws.close();
+            } catch {
+              /* ignore */
+            }
           },
           connectError(_socket, err) {
             console.error('[desktop] TCP connect error:', err.message);
             sessions.delete(ws);
-            try { ws.close(4004, 'VNC server unavailable'); } catch { /* ignore */ }
+            try {
+              ws.close(4004, 'VNC server unavailable');
+            } catch {
+              /* ignore */
+            }
           },
           open(socket) {
-            // Flush any pending messages
             for (const msg of session.pendingMessages) {
               socket.write(msg);
             }