feat: add VM RDP tunnel command

[MuNeNiCK]

Summary

• add mni vm rdp <name> [--port N]
• expose the authenticated VM RDP subresource only on 127.0.0.1
• keep the guest RDP destination controlled by vm-agent; the CLI cannot select a guest host or port

Test plan

• go test ./... -count=1
• go vet ./...