feat(core): RDP client on IronRDP

clients::rdp connects over any caller-dialled TCP stream (direct, proxy
or SSH tunnel), upgrades to TLS and logs on with NLA (CredSSP/NTLM),
optionally falling back to TLS-only logon for servers without NLA such
as xrdp (credentials are passed so they log straight in). The server
certificate is pinned through a caller check on its SHA256 fingerprint
before any credentials are sent. The desktop decodes into the VNC
client's RGBA framebuffer; input (IronRDP's scancode/Unicode/mouse
operations), Display Control resizes and the deactivation-reactivation
sequence run on the session thread.

IronRDP's releases need three vendored patches (vendor/README.md):
picky and sspi with their RustCrypto release-candidate pins relaxed so
they share russh's stable versions (their own suites, 402 tests, pass
against them), and ironrdp-session with two unreleased upstream bitmap
fixes (#1486 stride, #1524 RDP6 orientation) without which xrdp desktops
render sheared.

Verified live against xrdp (scottyhardy/docker-remote-desktop): logon,
full desktop rendering, keyboard and mouse input.

rust/vendor/README.md

@@ -0,0 +1,19 @@
+# Vendored crates
+
+Patched copies used through `[patch.crates-io]` in `rust/Cargo.toml`. Remove each once an
+IronRDP release includes the fix it carries.
+
+| Crate | Upstream | Change |
+|---|---|---|
+| `picky` | 7.0.0-rc.25 (crates.io) | `=x.y.z-rc.N` RustCrypto pins relaxed to `^x.y.z-rc.N` (so the stable releases russh uses satisfy them); one unused import removed. |
+| `sspi` | 0.21.3 (crates.io) | Same pin relaxation. |
+| `ironrdp-session` | 0.11.0 (crates.io) | Upstream fixes not yet released: #1486 "preserve bitmap source stride" (commit `80bb81b344`, applied as-is) and the RDP6 orientation flip from #1524 (`8f1737a287`). Without them xrdp desktops render sheared and upside-down tile by tile. |
+
+Why: IronRDP pins `picky = "=7.0.0-rc.25"`, which pins `curve25519-dalek = "=5.0.0-rc.1"` and
+other release candidates; russh needs the stable `curve25519-dalek 5`, and Cargo can't build two
+semver-compatible versions of one crate. With the pins relaxed both resolve to the stable
+releases, and the `picky` and `sspi` unit suites (402 tests) pass against them.
+
+The `ironrdp-session` fixes are verified by the live test in `core/src/clients/rdp.rs`
+(`NEXUS_RDP_TEST="host port user password"`), run against xrdp; the published crate ships no
+unit tests.