fix(selfbot): smooth VNC capture via keepalive + stop ffmpeg leak on stream end

The Go-Live broadcast looked badly choppy: video and scrolling stuttered while
the cursor stayed smooth. Root cause is TigerVNC: it only refreshes its
framebuffer while a VNC client is attached, but the broadcast reads that
framebuffer with x11grab (not as a VNC client). With no viewer attached the
captured screen idled at ~1.5 fps (measured 3/30 distinct frames); the cursor
looked smooth only because x11grab overlays the live cursor on every frame.

- Add a headless RFB keepalive (vnc-keepalive.ts) that stays connected for the
  life of the stream and requests incremental framebuffer updates at the stream
  framerate. SelfbotStreamer starts it on broadcast start and tears it down on
  stop/self-end. Measured 3/30 -> 57/60 distinct frames at 60 fps. Fail-open;
  authenticates with VNC_PASSWORD or the ~/.config/tigervnc/passwd file.
- Fix a resource leak: when the Go-Live ended on its own, only the active flag
  was cleared, leaving the x11grab->nvenc ffmpeg running forever (pinning a CPU
  core while no media was transmitted, with only the gateway TCP left and no UDP
  media). The self-end path now tears down capture, keepalive and voice like
  stop() does.
- Tests for both paths (self-end teardown; keepalive DES auth, port mapping,
  password resolution). Add @types/bun so bun:test typechecks; document the
  keepalive and recommended Chrome flags in README and .env.example.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.env.example

@@ -44,7 +44,13 @@ WHISPER_MODEL=small
 # Docker desktop (VNC) — used only by the container image
 # ---------------------------------------------------------------------------
 # VNC viewer password (max 8 chars effective). Watch the screen at localhost:5901.
+# Also used by the broadcast keepalive: TigerVNC only refreshes its framebuffer
+# while a VNC client is attached, so the stream keeps a tiny client connected to
+# avoid a choppy (~1.5 fps) capture. Must match the VNC server's password. If
+# unset, the keepalive falls back to the obfuscated passwd file (VNC_PASSWD_FILE,
+# default ~/.config/tigervnc/passwd).
 VNC_PASSWORD=javis123
+# VNC_PASSWD_FILE=/home/claude/.config/tigervnc/passwd
 # Auto-opened page in the in-container Chrome.
 CHROME_START_URL=about:blank