Fix SPICE CA cert not applied: .vv format needs inline ca=, not tls-ca-file=<path>

Proxmox's spiceproxy API returns proxy as a ready-made "http://<addr>:3128"
URL and host as the real (often cluster-internal) SPICE target. buildVVFile
picked params.proxy first and wrote that whole URL into the .vv file's
host= field, and never emitted a proxy= line at all — so virt-viewer tried
to dial "http://<ip>:3128" as a literal hostname instead of tunneling
through the proxy, and every connection failed.

Bump to 1.0.7.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "proxmox-spice-client",
-  "version": "1.0.6",
+  "version": "1.0.8",
   "description": "VDI SPICE Client f\u00fcr Proxmox",
   "main": "src/main.js",
   "scripts": {

src/main.js

@@ -266,17 +266,27 @@ ipcMain.handle('settings:setAutoConnect', (_e, target) => {
 function buildVVFile(params, vmid, client) {
   const lines = ['[virt-viewer]', `type=${params.type || 'spice'}`];
 
-  const host = params.proxy || params.host || client.host.split(':')[0];
+  // params.host = the real SPICE target (often a cluster-internal node
+  // address) and params.proxy = a ready-made "http://<reachable-host>:3128"
+  // URL that virt-viewer tunnels through via HTTP CONNECT. They are two
+  // different .vv fields — writing params.proxy into host= (as before)
+  // handed virt-viewer a full URL as a hostname and never opened the
+  // tunnel, so it tried (and failed) to dial the internal address directly.
+  const host = params.host || client.host.split(':')[0];
   lines.push(`host=${host}`);
 
   if (params['tls-port']) lines.push(`tls-port=${params['tls-port']}`);
   if (params.port) lines.push(`port=${params.port}`);
   if (params.password) lines.push(`password=${params.password}`);
+  if (params.proxy) lines.push(`proxy=${params.proxy}`);
 
+  // virt-viewer's .vv format only understands the CA inline via `ca=`, with
+  // newlines escaped as literal "\n" -- there is no `tls-ca-file=<path>` key,
+  // so pointing at a temp .pem file was silently ignored and left the
+  // self-signed cluster CA unverified, failing the TLS handshake.
   if (params.ca) {
-    const caPath = path.join(os.tmpdir(), 'proxmox-spice-ca.pem');
+    const caInline = String(params.ca).replace(/\r\n|\r|\n/g, '\\n');
-    fs.writeFileSync(caPath, params.ca);
+    lines.push(`ca=${caInline}`);
-    lines.push(`tls-ca-file=${caPath}`);
   }
   if (params['host-subject']) lines.push(`host-subject=${params['host-subject']}`);
 
@@ -291,11 +301,11 @@ function buildVVFile(params, vmid, client) {
   const vvPath = path.join(os.tmpdir(), `spice-${vmid}-${Date.now()}.vv`);
   fs.writeFileSync(vvPath, lines.join('\n') + '\n', { mode: 0o600 });
 
-  // Surfaced to the renderer so a failed connection (e.g. Proxmox handing out
+  // Surfaced to the renderer so a failed connection is diagnosable without
-  // a cluster-internal node address the client can't route to) is diagnosable
+  // having to catch the .vv file before remote-viewer deletes it.
-  // without having to catch the .vv file before remote-viewer deletes it.
   const port = params['tls-port'] || params.port || '?';
-  return { vvPath, target: `${host}:${port}` };
+  const target = params.proxy ? `${host}:${port} via ${params.proxy}` : `${host}:${port}`;
+  return { vvPath, target };
 }
 
 // VirtViewer's Windows installer names its folder after the bundled version