VDI: track desktop sessions and reclaim conservatively

[hanthor]

Part of #69.

Depends on #226 and the self-service broker child of #69.

Current behavior

corral vdi unassign stops a member only after an explicit administrator action. Corral does not track VDI console presence or reclaim abandoned claims.

Desired behavior

Add Phase 2 session state and a conservative reclaim controller based on explicit release, console disconnect grace, reconnect cancellation, and optional maximum duration. Do not equate websocket age with user input activity.

Acceptance criteria

• Track session connection/disconnection separately from assignment ownership.
• Explicit release reclaims immediately; disconnect starts a configurable grace period; reconnect cancels the pending reclaim.
• An optional maximum session duration is enforced independently of disconnect state.
• Persistent members stop and retain disks after reclaim; ephemeral VM members are recreated from their golden source.
• Administrator force-release behavior and audit events are defined.
• Restart/reconciliation behavior is deterministic and does not reclaim a live claim merely because the broker restarted.
• Fake-clock tests cover reconnect races, duplicate events, grace expiry, maximum duration, and lifecycle failures.
• Documentation clearly states that true input-idle reclaim requires an optional guest/protocol signal and is not implemented here.

Out of scope

Guest agents for keyboard/mouse idle detection and CT-backed pool reconciliation are separate work.