fix(rdp): clipboard only on explicit paste, size check before allocation, bounded device I/O

- The local clipboard was offered to the RDP server every time the
  desktop gained focus, so any server could read the last thing copied
  (a password, a token) without a paste. It now goes only on Ctrl/Cmd+V
  or Paste Clipboard.
- The server-chosen desktop size is checked before DecodedImage
  allocates it (65535x65535 is 16 GiB, and allocation failure aborts the
  whole app), at connect and on reactivation.
- Drive reads are clamped to 8 MiB per request (the native backend
  allocated the server's u32 length up front).
- Print jobs get unique files created exclusively (same-second jobs used
  to truncate each other) and at most 4 may be open at once.

rust/app/src/desktop_view.rs

@@ -446,15 +446,9 @@ impl DesktopView {
             resp.request_focus();
         }
         let focused = resp.has_focus();
-        // RDP shares the clipboard both ways: offer the local text whenever the desktop gains focus.
-        if focused
-            && !self.had_focus
-            && let Some(Remote::Rdp(c)) = &self.client
-            && let Ok(text) = arboard::Clipboard::new().and_then(|mut c| c.get_text())
-            && !text.is_empty()
-        {
-            c.set_clipboard(text);
-        }
+        // The local clipboard goes to the remote desktop only on an explicit paste (Ctrl/Cmd+V or
+        // Paste Clipboard). Offering it whenever the desktop gained focus let any server read
+        // whatever was last copied (a password, a token) without the user pasting anything.
         if focused {
             ui.painter().rect_stroke(img, 0.0, egui::Stroke::new(1.0, Tokens::get(ui.ctx()).accent.gamma_multiply(0.6)), egui::StrokeKind::Outside);
             ui.memory_mut(|m| m.set_focus_lock_filter(id, egui::EventFilter { tab: true, horizontal_arrows: true, vertical_arrows: true, escape: true }));