Replace noVNC with KasmVNC, add anti-detection Chromium args

[bicced]

Summary

• KasmVNC replaces TigerVNC + noVNC + websockify — single process with modern web client, seamless clipboard, smooth scrolling, and webp compression. Fixes the "oldschool" noVNC UI with no paste/scroll support.
• Anti-detection Chromium args — --disable-blink-features=AutomationControlled, ignore_default_args=["--enable-automation"], custom user-agent hide Playwright automation markers. Fixes X.com only showing the X logo.
• CPU quota bumped to 100% of one core for persistent mode (was 50%), since visible Chromium + VNC needs more processing power.
• Simplified architecture — removed _novnc_proc global, VNC_PASSWORD generation, password query params from dashboard URLs. KasmVNC BasicAuth is disabled; access control relies on Docker port mapping.

Changes

File	What changed
Dockerfile.agent	Replace tigervnc-standalone-server tightvncpasswd novnc websockify with KasmVNC 1.4.0 .deb
browser_tool.py	Anti-detection args in _launch_persistent(), KasmVNC single-process in start_persistent_browser(), remove _novnc_proc
runtime.py (host)	Remove VNC_PASSWORD, bump cpu_quota to 100000 for persistent, simplify vnc_url
server.py (dashboard)	URL from /vnc.html?autoconnect=true to /, remove vnc_password from API responses
index.html	Remove password query params from iframe/links
runtime.py (CLI)	Remove VNC password from CLI output
Tests	Updated for KasmVNC single-process model and removed password assertions

Test plan

• pytest tests/test_builtins.py tests/test_runtime.py -x -v — all 161 pass
• pytest tests/ --ignore=tests/test_e2e*.py -x — all 1264 pass
• ruff check — clean
• Rebuild Docker image: docker build --platform linux/amd64 -t openlegion-agent:latest -f Dockerfile.agent .
• Start with persistent browser, verify KasmVNC web client loads in dashboard iframe
• Navigate to x.com, verify it loads fully (not just X logo)