feat(wayvnc): add config and user service for tailnet-only VNC access

Binds to the tailscale IP only, with PAM auth over TLS. TLS cert/key
are machine-local secrets and intentionally not tracked.

.config/systemd/user/wayvnc.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=wayvnc - VNC server for wlroots Wayland compositors
+After=graphical-session.target
+PartOf=graphical-session.target
+Requisite=graphical-session.target
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/wayvnc
+Restart=on-failure
+RestartSec=2
+
+[Install]
+WantedBy=graphical-session.target

.config/wayvnc/config

@@ -0,0 +1,6 @@
+address=100.64.0.1
+port=5900
+enable_auth=true
+enable_pam=true
+certificate_file=/home/valknar/.config/wayvnc/tls_cert.pem
+private_key_file=/home/valknar/.config/wayvnc/tls_key.pem

.gitignore

@@ -58,6 +58,11 @@
 !.config/zed/settings.json
 !.config/uwsm/
 !.config/uwsm/env
+!.config/wayvnc/
+!.config/wayvnc/config
+!.config/systemd/
+!.config/systemd/user/
+!.config/systemd/user/wayvnc.service
 !.config/kitty/
 !.config/kitty/kitty.conf
 !.config/kitty/themes/