fix(#1988): correct stale api/state reference in vnc auth comment

frontend/packages/agent/src/screen.html

@@ -453,7 +453,7 @@
             // BEFORE PAM is ever consulted — an empty/garbage username is
             // rejected outright. Our weston runs as the agent's own
             // non-root user (weston-vnc.nix forbids root), so the username
-            // must be that agent's name — resolved from /api/dashboard-state
+            // must be that agent's name — resolved from `api/state`
             // above. The password stays empty; pam_permit.so on the
             // weston-remote-access PAM service accepts it.
             const username = (await agentLabelPromise) || 'root';