fix: anti-idle uses xdotool --window; remove creds from URL

rdp-proxy/manager.py: anti_idle_loop gets window ID first, then sends
key --window ID --clearmodifiers shift (was broken chain syntax).
universal-runtime/manager.py: removed credentials from URL - they break
SPA fetch() calls causing white screen (e.g. CGP).

universal-runtime/manager.py

@@ -352,8 +352,7 @@ def open_web(
     safe_w, safe_h = apply_resolution(width, height)
     profile_dir = _create_chrome_profile()
     extension_dir = _create_autofill_extension(login, password)
-    # Embed credentials in URL for HTTP Basic Auth (no dialog shown)
-    url_with_creds = _url_with_credentials(url, login, password)
+    url_with_creds = url  # credentials in URL break SPA fetch; extension handles auth
 
     # Use the real Chromium binary directly to avoid the Debian wrapper which
     # injects an empty `--load-extension=` from /etc/chromium.d/extensions.