feat(wayvnc): add config and user service for tailnet-only VNC access

Binds to the tailscale IP only, with PAM auth over TLS. TLS cert/key
are machine-local secrets and intentionally not tracked.

.config/systemd/user/wayvnc.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=wayvnc - VNC server for wlroots Wayland compositors
+After=graphical-session.target
+PartOf=graphical-session.target
+Requisite=graphical-session.target
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/wayvnc
+Restart=on-failure
+RestartSec=2
+
+[Install]
+WantedBy=graphical-session.target