Replace VNC JWT auth with a Noise_IK handshake bound to ACL-pushed pubkeys

shared/management/http/api/openapi.yml

@@ -1007,6 +1007,10 @@ components:
           items:
             type: string
             example: "tcp/80"
+        session_pub_key:
+          description: Ephemeral Ed25519 public key the requester will sign session-binding challenges with. Required for VNC rules; ignored for SSH and L4.
+          type: string
+          example: "n0r3pL4c3h0ld3rK3y=="
       required:
         - name
         - wg_pub_key
@@ -1028,10 +1032,15 @@ components:
           items:
             type: string
             example: "tcp/80"
+        target_pub_key:
+          description: Identity public key of the destination peer the temporary access was requested for. Used by the requester to verify the destination daemon's identity before transmitting credentials.
+          type: string
+          example: "n0r3pL4c3h0ld3rK3y=="
       required:
         - name
         - id
         - rules
+        - target_pub_key
     AccessiblePeer:
       allOf:
         - $ref: '#/components/schemas/PeerMinimum'

shared/management/http/api/types.gen.go

@@ -3391,6 +3391,9 @@ type PeerTemporaryAccessRequest struct {
 	// Rules List of temporary access rules
 	Rules []string `json:"rules"`
 
+	// SessionPubKey Ephemeral Ed25519 public key the requester will sign session-binding challenges with. Required for VNC rules; ignored for SSH and L4.
+	SessionPubKey *string `json:"session_pub_key,omitempty"`
+
 	// WgPubKey Peer's WireGuard public key
 	WgPubKey string `json:"wg_pub_key"`
 }
@@ -3405,6 +3408,9 @@ type PeerTemporaryAccessResponse struct {
 
 	// Rules List of temporary access rules
 	Rules []string `json:"rules"`
+
+	// TargetPubKey Identity public key of the destination peer the temporary access was requested for. Used by the requester to verify the destination daemon's identity before transmitting credentials.
+	TargetPubKey string `json:"target_pub_key"`
 }
 
 // PersonalAccessToken defines model for PersonalAccessToken.