Establish (or re-establish) the web console connection for an instance

Establishes the UI-requested console connection for the selected instance in the active tenant/subscription/project scope, as triggered by the "Connect" action button in the instance console page. The API allocates (or refreshes) a console session and returns the full session facts the console page renders: the wss:// endpoint with an embedded one-time console token, protocol (RFB/noVNC), frame encoding, TLS cipher, resolution, keyboard layout, clipboard policy, token expiry and session start time. Re-connecting after a disconnect resets the framebuffer epoch so the boot stream replays from the beginning. Validation: scopeId must be accessible to the caller (404 via ErrNotFound when unknown); instanceId must identify an instance in that scope (404 NOT_FOUND otherwise); the instance's current state must permit a console connection — an instance that is deleted or in a state that cannot accept console sessions maps to 409 CONFLICT. Async & state: Synchronous command returning 200 with the established ConsoleSession; the session transitions connecting → connected server-side and the console badge state is surfaced to other open consoles via resource.updated SSE frames of kind compute.consoleSession (patch: state, startedAt, tokenExpiresAt). No durable instance state is changed. Errors: 401 unauthenticated; 403 caller lacks an instance-console-capable role (owner|admin|contributor) on the scope; 404 unknown scopeId or instanceId; 409 when the instance state does not permit connect (e.g. stopped/terminating); 422 on malformed input; 500 on console-broker failure. Idempotency/Concurrency: Send an Idempotency-Key; replaying the same key returns the same session (same token and wsUrl) instead of allocating a second session. Concurrent connects to the same instance from the same principal coalesce onto one session.