Remote Tor Browser isolation

`subtor` provisions an isolated disposable VM for each authenticated session and embeds the viewer inside the app.

• OIDC sign-in with role-aware access control
• Ephemeral VM lifecycle with audit logging
• No public viewer endpoint without app authorization