fix: split noVNC to separate vnc.ampbox.io host for WebSocket support

- FastAPI httpx proxy can't handle WebSocket upgrades (status 101)
- noVNC iframe now points to vnc.ampbox.io (port 6080 via cloudflared)
- App UI stays at browser.ampbox.io (port 8080 via cloudflared)
- Auto-detects local vs ampbox.io for iframe src

static/index.html

@@ -484,7 +484,7 @@
       <span>Live Browser -- browser.ampbox.io</span>
     </div>
     <div class="browser-frame">
-      <iframe src="/vnc.html?autoconnect=true&resize=scale&reconnect=true&reconnect_delay=1000" allow="clipboard-read; clipboard-write"></iframe>
+      <iframe id="vnc-frame" src="about:blank" allow="clipboard-read; clipboard-write"></iframe>
     </div>
   </div>
 
@@ -780,5 +780,18 @@ function escHtml(s) {
 loadGuide();
 loadSaved();
 </script>
-</body>
+
+    <script>
+      // Point noVNC iframe to vnc.ampbox.io (separate cloudflare tunnel to port 6080)
+      const vncFrame = document.getElementById('vnc-frame');
+      const host = window.location.hostname;
+      const proto = window.location.protocol;
+      // In production: vnc.ampbox.io. Locally: same host, port 6080.
+      if (host.endsWith('.ampbox.io')) {
+        vncFrame.src = proto + '//vnc.ampbox.io/vnc.html?autoconnect=true&resize=scale&reconnect=true&reconnect_delay=1000';
+      } else {
+        vncFrame.src = proto + '//' + host + ':6080/vnc.html?autoconnect=true&resize=scale&reconnect=true&reconnect_delay=1000';
+      }
+    </script>
+  </body>
 </html>