feat(rdp): RD Gateway transport (experimental)

RDP profiles can go through a Remote Desktop Gateway (MS-TSGU over an
HTTPS WebSocket) with its own username and password, stored like other
credentials (rdp-gateway-password). The gateway stream is bridged to a
loopback socket so the blocking RDP client uses it like any transport.

IronRDP's gateway crate (0.0.1) is vendored with fixes: it used
ironrdp-tls, which accepts any certificate, before sending Basic
credentials — the gateway is now verified against the web PKI; its
asserts on gateway-supplied lengths are errors instead of panics; and
the server port is passed through. Checked against a self-signed
openssl s_server: the connection is refused ('invalid peer certificate')
before any request or credential is sent. Not tested against a real
gateway; Basic-auth gateways only (no NTLM).

rust/core/src/models.rs

@@ -418,6 +418,10 @@ pub struct RdpConfig {
     /// Trust policy for the server's TLS certificate (pinned like an SSH host key).
     #[serde(deserialize_with = "lenient")]
     pub host_key_policy: HostKeyPolicy,
+    /// RD Gateway (`host` or `host:port`, HTTPS); empty connects without one. Basic auth only.
+    pub gateway_host: String,
+    pub gateway_username: String,
+    pub gateway_secret_mode: SecretMode,
     /// "none", "socks5" or "http"; the password is a stored secret.
     pub proxy_type: String,
     pub proxy_host: String,