security(vnc): docker-compose deployments have no VNC password provisioning at all #17059

Problem

Found while implementing #16299's VNC slice. desktop_streaming_manager.py's
_start_vnc_server launches x11vnc -rfbauth {config.path.vnc_passwd_path}
(default /home/autobot-vnc/.vnc/x11vnc.passwd, AUTOBOT_VNC_PASSWD_FILE),
requiring that file to already exist and hold a real x11vnc-format password.

The ansible/SLM-managed deployment path populates it:
autobot-slm-backend/ansible/roles/vnc/tasks/main.yml:182-223 generates a
random password into /etc/autobot/vnc-secrets.env, then writes it via both
vncpasswd -f and x11vnc -storepasswd.

A pure docker-compose deployment (no ansible/SLM at all) has no equivalent
mechanism: docker/, docker-compose.yml, and every Dockerfile* were
grepped for vnc-secrets/vnc_passwd/storepasswd/VNC_PASSWORD — zero
hits. Nothing populates config.path.vnc_passwd_path on that path, so
_start_vnc_server's -rfbauth flag points at a file that likely doesn't
exist, and the desktop-streaming VNC feature is probably non-functional
under docker-compose today. Not confirmed by running it (no live environment
to test against here) — this issue is filed on the code-reading evidence
above, not observed failure.

Scope

• Confirm whether _start_vnc_server actually works under docker-compose
  today (or has a separate code path this grep missed)
• If it doesn't: add generate-on-first-run VNC password provisioning to
  the docker-compose path, following the same pattern the rest of security: guessable default credentials ship in templates, ansible defaults and the compose file #16299
  established, and register it in the canonical secrets system
  (POST /api/v2/secrets/system) the same way the ansible vnc role now
  does — not a parallel plaintext-file mechanism

Filed as a sub-issue of #16299; out of scope for that issue's credential-leak
fix (this is a missing feature, not a leak).