refactor(rego-tunnel): Replace QEMU VM with native Docker Cisco VPN

- Switch from linux-vm QEMU image to cisco-vpn native Docker image
- Change port from 8006 to 6080 (noVNC)
- Remove VM-specific config (RAM, CPU, bridges, taps, QEMU)
- Add VPN credential fields (email, password, TOTP, VPN host)
- Add auto-connect and VNC password options
- Update description.md with new documentation
- Simplify Docker requirements (no /dev/kvm needed)

Benefits:
- No QEMU/VM overhead - runs natively in Docker
- Full Cisco Secure Client 5.1.14.145 with GUI
- Auto-login with TOTP support
- Auto-reconnect on disconnect

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

apps/rego-tunnel/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   rego-tunnel:
-    image: git.alexzaw.dev/alexz/linux-vm:latest
+    image: git.alexzaw.dev/alexz/cisco-vpn:latest
     restart: unless-stopped
     networks:
       rego-tunnel_runtipi_network:
@@ -8,41 +8,29 @@ services:
       tipi_main_network:
         gw_priority: 1
     environment:
-      VM_RAM: ${WINDOWS_RAM_GB}G
-      VM_CPUS: ${WINDOWS_CPU_CORES}
-      BRIDGE_NAME: ${BRIDGE_NAME}
-      TAP_NAME: ${TAP_NAME}
-      TAP2_NAME: ${TAP2_NAME}
-      BRIDGE_CIDR: ${BRIDGE_CIDR}
-      VM_NET_IP: ${VM_NET_IP}
-      VM_SUBNET: ${VM_SUBNET}
-      TARGET_IP: ${TARGET_IP}
-      VM_MAC: ${VM_MAC}
-      VM_MAC2: ${VM_MAC2}
-      DNS_SERVERS: ${DNS_SERVERS}
-      LEASE_TIME: ${LEASE_TIME}
-      HOSTSHARE_DIR: ${HOSTSHARE_DIR}
-      BRIDGE2_NAME: ${BRIDGE2_NAME}
-      BRIDGE2_CIDR: ${BRIDGE2_CIDR}
-      BRIDGE2_UPLINK_IF: ${BRIDGE2_UPLINK_IF}
-      QEMU_BIN: ${QEMU_BIN}
+      VPN_EMAIL: ${VPN_EMAIL}
+      VPN_PASSWORD: ${VPN_PASSWORD}
+      VPN_TOTP_SECRET: ${VPN_TOTP_SECRET}
+      VPN_HOST: ${VPN_HOST}
+      VPN_AUTO_CONNECT: ${VPN_AUTO_CONNECT}
+      VNC_PASSWORD: ${VNC_PASSWORD}
+      TZ: ${TZ}
     ports:
-      - ${APP_PORT}:8006
+      - ${APP_PORT}:6080
     volumes:
-      - /etc/runtipi/user-config/runtipi/rego-tunnel/storage/linux-vm.qcow2:/vm/linux-vm.qcow2
+      - ${APP_DATA_DIR}/config:/config
       - /etc/runtipi/user-config/runtipi/rego-tunnel/shared:/shared
-      - ${HOSTSHARE_DIR}:/hostshare
     labels:
       generated: true
       traefik.enable: true
       traefik.docker.network: runtipi_tipi_main_network
       traefik.http.middlewares.rego-tunnel-runtipi-web-redirect.redirectscheme.scheme: https
-      traefik.http.services.rego-tunnel-runtipi.loadbalancer.server.port: "8006"
+      traefik.http.services.rego-tunnel-runtipi.loadbalancer.server.port: "6080"
       traefik.http.routers.rego-tunnel-runtipi-insecure.rule: Host(`${APP_DOMAIN}`)
       traefik.http.routers.rego-tunnel-runtipi-insecure.entrypoints: web
       traefik.http.routers.rego-tunnel-runtipi-insecure.service: rego-tunnel-runtipi
       traefik.http.routers.rego-tunnel-runtipi-insecure.middlewares: rego-tunnel-runtipi-web-redirect
-      traefik.http.middlewares.rego-tunnel-runtipi-auth.basicauth.users: "alexz:$$2y$$05$$nv5ygL66/LEYut3RBuslFuXBwHIDg1yKFmhB8B4Nyqd8GJnN4gy5u"
+      traefik.http.middlewares.rego-tunnel-runtipi-auth.basicauth.users: "${BASICAUTH_USERS}"
       traefik.http.routers.rego-tunnel-runtipi.rule: Host(`${APP_DOMAIN}`)
       traefik.http.routers.rego-tunnel-runtipi.entrypoints: websecure
       traefik.http.routers.rego-tunnel-runtipi.service: rego-tunnel-runtipi
@@ -53,8 +41,6 @@ services:
     cap_add:
       - NET_ADMIN
     devices:
-      - /dev/kvm
       - /dev/net/tun
     privileged: true
-    stop_grace_period: 2m
-    sysctls: {}
+    stop_grace_period: 30s