feat(instances): a VM's access in one strip, its console password kept to its rule

The Access tab hid the console, the root password, the SSH key and the
remote viewer behind four sub-tabs. The owner chose a compact layout
from three rendered options: the state, a strip with the console and
the remote viewer, then two rows for root's password and key, each
saying why it waits when it does.

Codex reviewed access end to end; these are fixed:

- console.vv carries the console password only for users with the
  passwordless console permission, as the console page passes it; it
  gave it to every user who may open the console.
- The root password field is a labelled password input, not plain text
  with a 24-character limit.
- Without a saved public key the key row is disabled and points to the
  profile, instead of offering "None".
- A paused VM's console opens, as the console view allows.
- The remote viewer address and console.vv show only for a VNC or SPICE
  console that listens beyond the host's loopback; a viewer on the
  user's computer cannot reach the others, and a serial console gave a
  pty://…:None address.

instances/tests/test_console_rule.py

@@ -64,8 +64,16 @@ class CanOpenConsoleTestCase(TestCase):
         self.assertEqual(res.status_code, 200)
         self.assertIn(b"[virt-viewer]", res.content)
         # the VM found by its UUID; a console on all addresses is reached through the host
-        for line in (b"type=vnc", b"host=192.0.2.7", b"port=5900", b"title=cons-vm", b"password=secret"):
+        for line in (b"type=vnc", b"host=192.0.2.7", b"port=5900", b"title=cons-vm"):
             self.assertIn(line + b"\n", res.content)
+        # the password only with the permission the console page asks for, as there
+        self.assertNotIn(b"password=", res.content)
+        self.owner.user_permissions.add(Permission.objects.get(codename="passwordless_console"))
+        with patch("instances.models.wvmInstance") as wvm:
+            proxy = wvm.return_value.cached_reads.return_value.__enter__.return_value
+            proxy.get_console_passwd.return_value = "secret"
+            res = self.client.get(reverse("instances:getvvfile", args=[self.instance.id]))
+        self.assertIn(b"password=secret\n", res.content)
 
     def test_owner_can_get_vdi_url(self):
         self.client.force_login(self.owner)