Fix(Go): stable device list ordering + RDP-reset handler

Fix UTF-8 login text decode + stale screen sub-conn retirement

server/go/web/ws_handlers.go

@@ -33,7 +33,7 @@ func (h *wsHub) dispatch(c *wsClient, cmd string, raw []byte) {
 	case "connect":
 		h.handleConnect(c, raw)
 	case "rdp_reset":
-		// silently ignored — UI uses this as a fire-and-forget
+		h.handleRdpReset(c, raw)
 	case "mouse":
 		h.handleMouse(c, raw)
 	case "key":
@@ -311,6 +311,36 @@ func (h *wsHub) handleConnect(c *wsClient, raw []byte) {
 	c.queue(mustJSON(map[string]any{"cmd": "connect_result", "ok": true}))
 }
 
+// handleRdpReset asks the device to switch its screen capture back to the
+// physical console session ("RDP 会话归位"). Useful when someone has RDP'd into
+// the box: the device's screen thread is by default attached to whatever WTS
+// session is currently active, so the operator may otherwise see a login
+// screen or a different user's desktop instead of the local console.
+//
+// Fire-and-forget on purpose, matching the C++ server and the browser UI —
+// front-end ignores any reply, so we don't send one. Failures (device offline,
+// no active screen session, browser hasn't called `connect` yet) are warn-
+// logged server-side only.
+func (h *wsHub) handleRdpReset(c *wsClient, raw []byte) {
+	if !h.requireAuth(c, raw, "rdp_reset_result") {
+		return
+	}
+	deviceID := c.watching
+	if deviceID == "" {
+		h.log.Warn("rdp_reset: no device watched (addr=%s role=%s)", c.addr, c.role)
+		return
+	}
+	// CMD_RESTORE_CONSOLE must go through the screen sub-conn — the client
+	// dispatches it from CScreenManager::OnReceive, which only reads from
+	// the screen sub-conn (see client/ScreenManager.cpp:996). Sending on the
+	// main conn would silently no-op.
+	if err := h.devices.SendToScreen(deviceID, []byte{protocol.CmdRestoreConsole}); err != nil {
+		h.log.Warn("rdp_reset: device=%s: %v", deviceID, err)
+		return
+	}
+	h.log.Info("rdp_reset sent: device=%s", deviceID)
+}
+
 func (h *wsHub) handleGetDevices(c *wsClient, raw []byte) {
 	if !h.requireAuth(c, raw, "device_list") {
 		return