noVNC console disconnects when Jetty WebSocket reaches idle timeout on CloudStack 4.22.1.1

### problem

The noVNC console disconnects while the guest VM, Console Proxy VM,
CloudStack agent, network connectivity, and KVM VNC backend remain
operational.

The browser displays:

`Failed to connect to server / access token has expired`

The console disconnects even while the noVNC session is actively being used
with keyboard input and screen updates. This is not an inactive or abandoned
browser session.

Closing the old console window and opening a new console session from the
CloudStack UI generates a new access token and temporarily restores access.
The newly generated session eventually disconnects again.

Observed CPVM log messages include:

`Idle timeout expired: 300001/300000 ms`

After the disconnection, or when the previous console session attempts to
reconnect, the CPVM log reports:

`External authenticator failed`

The browser WebSocket initially completes its handshake with HTTP status 101.

During the failure:

- The guest VM remains Running.
- The Console Proxy VM remains Running.
- The Console Proxy agent remains Up.
- The CPVM public interface and TCP port 8080 remain reachable.
- The KVM VNC listener remains active.
- Reopening the console from the CloudStack UI immediately works with a newly
generated token.

The observed traffic path is:

Browser → CPVM public interface TCP 8080 → CPVM private interface →
KVM VNC endpoint → guest VM

### versions

- Apache CloudStack Management Server: 4.22.1.1
- cloudstack-common: 4.22.1.1
- cloudstack-agent: 4.22.1.1
- System VM template/version: 4.22.1.1
- Management Server OS: Ubuntu 24.04 LTS
- KVM Host OS: Ubuntu 24.04 LTS
- Hypervisor: KVM/libvirt
- Host and System VM architecture: aarch64
- Browser: Google Chrome
- Zone network type: Advanced
- Console Proxy VM state: Running
- Console Proxy agent state: Up
- `novnc.console.default`: `true`
- `consoleproxy.session.timeout`: `300000`

No reverse proxy or external load balancer is placed between the browser and
the Console Proxy VM.

### The steps to reproduce the bug

1. Deploy and start a guest VM on an aarch64 KVM host.
2. Confirm that the guest VM and Console Proxy VM are Running and their agents
are Up.
3. Open the guest console from the CloudStack UI using the default noVNC
console.
4. Confirm that the browser WebSocket handshake returns HTTP status 101.
5. Continuously interact with the console using keyboard input and observe
ongoing screen updates.
6. Observe that the console disconnects after approximately 2–5 minutes,
despite the active session.
7. Confirm that the guest VM remains Running.
8. Confirm that the CPVM public interface and TCP port 8080 remain reachable.
9. Confirm that the KVM VNC listener remains active.
10. Observe `Idle timeout expired: 300001/300000 ms` in the CPVM log.
11. Observe `External authenticator failed` when the previous session attempts
to reconnect, or observe the browser message
`Failed to connect to server / access token has expired`.
12. Close the old console window and open the console again from the
CloudStack UI.
13. Confirm that the newly generated token restores console access
temporarily.

### What to do about it?

Expected behavior:

An actively used noVNC console should remain connected while the guest VM,
Console Proxy VM, network path, and KVM VNC backend remain healthy.

Active keyboard input, WebSocket traffic, and VNC framebuffer updates should
prevent the connection from being treated as idle.

If `consoleproxy.session.timeout` is intended to apply to noVNC sessions, the
configured value should be handled consistently by the Jetty WebSocket idle
timeout and the Console Proxy viewer garbage-collection logic.

Please confirm:

1. Whether this behavior is addressed by PR #13002.
2. Whether that fix is included in any released 4.22 package.
3. Whether a backport to the maintained 4.22 branch is planned.
4. Whether there is a supported workaround for CloudStack 4.22.1.1.
5. Whether `consoleproxy.session.timeout` should control both the Jetty
WebSocket idle timeout and Console Proxy viewer garbage collection.
6. Whether applying a changed timeout requires restarting the Management
Server, restarting the Console Proxy VM, or recreating the Console Proxy VM.

### Security note

Console URLs, authentication tokens, API credentials, passwords, SSH keys,
MAC addresses, UUIDs, and sensitive infrastructure identifiers have been
removed from this report.

Iniziare tracciando la gestione dell’idle timeout di Jetty WebSocket e il comportamento del garbage collection del viewer di Console Proxy in relazione all’impostazione segnalata di 300000 ms. Riprodurre il problema della sessione noVNC attiva usando i passaggi elencati e i messaggi di log CPVM, quindi verificare che una sessione attiva rimanga connessa e che la configurazione del timeout venga gestita in modo coerente.

Scritto dal modello di indicizzazione a partire dal testo della issue.