fix(windows-rdp): escape special characters in RDP credentials - #1034

Problem

The password shown in the Coder UI and the password that reaches the Devolutions login form can differ, because the module interpolates credentials into two different languages without escaping either of them:

1. devolutions-patch.js embeds the password inside a double-quoted JS string literal (value: "${CODER_PASSWORD}"). JS parses the injected \m as an escape sequence and drops the backslash, so N;JVO*U\mL^a*P becomes N;JVO*UmL^a*P. A " in the password breaks the patch script entirely.
2. powershell-installation-script.tftpl passes the password as a PowerShell double-quoted string (Set-AdminPassword -adminPassword "${admin_password}"), where $, backtick, and " are all interpreted. The Windows account then gets a different password than the one Coder displays.

Both paths end in STATUS_LOGON_FAILURE [0xc000006d], and whether a user hits it depends on which characters their generated password happens to contain.

Fix

Encode each value for its destination:

The JS file keeps a real string literal, so it stays valid JavaScript for Prettier and @ts-check.

Changes

• main.tf: add locals that JSON-escape credentials for the JS patch and PowerShell-escape them for the installation script
• powershell-installation-script.tftpl: use single-quoted strings for the username and password
• main.test.ts: parse the emitted JS literal with JSON.parse instead of a naive [^"]+ regex, and add a case covering \ " ' $ & < > | { } [ ] % @ : ~`
• Bump module version to 1.3.1

Validation

Rendered script output with password N;JVO*U\mL^a*P"' + ` + $&<>|:

value: "N;JVO*U\\mL^a*P\"'`$\u0026\u003c\u003e|",
Set-AdminPassword -adminPassword 'N;JVO*U\mL^a*P"''`$&<>|'

bun test main.test.ts passes (5/5); prettier and terraform fmt are clean.

Closes #20

🤖 This PR was created with the help of Coder Agents, and needs a human review. 🧑‍💻