feat(rdp): Kerberos logon through a configured KDC

An RDP profile can name a Kerberos KDC; CredSSP then authenticates with
Kerberos instead of NTLM, reaching the KDC through a small TCP client
(RFC 4120 length-prefixed framing, 5 s connect / 10 s read timeouts,
replies capped at 1 MiB so a hostile KDC can't force a huge allocation).
UDP KDCs are refused with a clear message. Tested against a fake KDC
(round trip, oversized reply, UDP); not against a real realm.

Smart-card logon is not implemented: it needs PC/SC hardware and a card
to build and test against.

rust/app/src/profile_editor.rs

@@ -691,6 +691,7 @@ impl ProfileEditor {
             if c.secret_mode == SecretMode::Saved {
                 secret(ui, "Password", secrets, SecretKind::RdpPassword, "Leave blank to keep the saved password");
             }
+            text(ui, "Kerberos KDC", &mut c.kerberos_kdc, "kdc.corp.example (empty: NTLM)");
             let opts: Vec<_> = HostKeyPolicy::ALL.iter().map(|k| (*k, k.label())).collect();
             combo(ui, "Certificate Policy", &mut c.host_key_policy, &opts);
             check(