feat: wire remote-desktop plugin into core and rename i18n keys

Repoints core consumers (dispatcher, collab, session-sharing, tab
utils) at the plugin, adds isTabTypeAvailable gating for rdp/vnc/
telnet, widens hostCapability to accept an array, and renames the
guacamole i18n namespace to remoteDesktop.

src/backend/hosts/collab/routes.ts

@@ -8,7 +8,14 @@ import {
   getAuditUsername,
   getRequestMeta,
 } from "../../utils/audit-logger.js";
-import { GuacamoleTokenService } from "../guacamole/token-service.js";
+// Remote Desktop is a first-party plugin (plugins/remote-desktop); this goes
+// through the same in-core bridge its router is mounted behind, since
+// plugins/ is compiled separately from src/backend/ and core cannot
+// statically import across that boundary. See
+// src/backend/database/routes/guacamole-dispatch.ts and that plugin's
+// README -- this is an accepted, temporary coupling until collab becomes a
+// plugin of its own.
+import { createGuacamoleJoinToken } from "../../database/routes/guacamole-dispatch.js";
 import { collabRoomHub } from "./room-hub.js";
 import { getStageController, setStageController } from "./stage-control.js";
 import { isCollabGuestRateLimited } from "./guest-rate-limit.js";
@@ -41,7 +48,6 @@ import type { CollabRoomRecord } from "../../database/repositories/collab-room-r
 const router = express.Router();
 const authManager = AuthManager.getInstance();
 const authenticateJWT = authManager.createAuthMiddleware();
-const tokenService = GuacamoleTokenService.getInstance();
 
 const STAGE_SHARE_EXPIRY_HOURS = 12;
 const MAX_INVITE_TARGETS = 200;
@@ -657,7 +663,7 @@ router.get(
       };
       if (protocol !== "ssh") {
         stage.connectParams = {
-          token: tokenService.createJoinToken(share.sessionId, true),
+          token: createGuacamoleJoinToken(share.sessionId, true),
         };
       }
       res.json({ stage });
@@ -1089,7 +1095,7 @@ router.get("/guest/:token", async (req: Request, res: Response) => {
                 }
               : {
                   connectParams: {
-                    token: tokenService.createJoinToken(share.sessionId, true),
+                    token: createGuacamoleJoinToken(share.sessionId, true),
                   },
                 }),
           };

src/backend/hosts/session-sharing/live-sessions.ts

@@ -1,5 +1,12 @@
 import { sessionManager } from "../terminal/session-manager.js";
-import { getGuacSessionInfo } from "../guacamole/guacamole-server.js";
+// Remote Desktop is a first-party plugin (plugins/remote-desktop); this goes
+// through the same in-core bridge its router is mounted behind, since
+// plugins/ is compiled separately from src/backend/ and core cannot
+// statically import across that boundary. See
+// src/backend/database/routes/guacamole-dispatch.ts and that plugin's
+// README -- this is an accepted, temporary coupling until collab/
+// session-sharing themselves become plugins.
+import { getGuacamoleSessionInfo as getGuacSessionInfo } from "../../database/routes/guacamole-dispatch.js";
 import {
   createCurrentHostResolutionRepository,
   createCurrentSettingsRepository,

src/backend/hosts/session-sharing/routes.ts

@@ -10,14 +10,20 @@ import {
   isLiveSessionOwnedBy,
   isSharingEnabledForHost,
 } from "./live-sessions.js";
-import { GuacamoleTokenService } from "../guacamole/token-service.js";
+// Remote Desktop is a first-party plugin (plugins/remote-desktop); this goes
+// through the same in-core bridge its router is mounted behind, since
+// plugins/ is compiled separately from src/backend/ and core cannot
+// statically import across that boundary. See
+// src/backend/database/routes/guacamole-dispatch.ts and that plugin's
+// README -- this is an accepted, temporary coupling until session-sharing
+// becomes a plugin of its own.
+import { createGuacamoleJoinToken } from "../../database/routes/guacamole-dispatch.js";
 import { createCurrentSessionShareRepository } from "../../database/repositories/factory.js";
 
 const router = express.Router();
 const authManager = AuthManager.getInstance();
 const authenticateJWT = authManager.createAuthMiddleware();
 const permissionManager = PermissionManager.getInstance();
-const tokenService = GuacamoleTokenService.getInstance();
 
 const DEFAULT_EXPIRY_HOURS = 24;
 const MAX_EXPIRY_HOURS = 24 * 30;
@@ -406,7 +412,7 @@ router.get("/resolve/:linkToken", async (req: Request, res: Response) => {
     };
 
     if (protocol !== "ssh") {
-      const joinToken = tokenService.createJoinToken(
+      const joinToken = createGuacamoleJoinToken(
         share.sessionId,
         share.permissionLevel === "read-only",
       );