Allow per-Windows-desktop browser favicon for Desktop Access sessions

What would you like Teleport to do?

Allow a Windows Desktop resource/session to use a desktop-specific browser tab favicon instead of always inheriting Teleport's global favicon.

This request is specifically about the favicon shown in the browser tab while using Windows Desktop Access, not the Windows icon shown on the unified resources card.

In Teleport Community/self-hosted v18.3.1, the Web UI defines global favicon assets such as:

/app/favicon-light.png
/app/favicon-dark.png

The initial HTML selects them using prefers-color-scheme, and the Web UI favicon update logic also derives the light/dark choice from the browser/system color-scheme preference. As a result, opening a Windows desktop session still shows the normal Teleport favicon in the browser tab.

It would be useful if the favicon could be overridden for an individual Windows Desktop resource/session, ideally using supported resource metadata/labels or another mechanism chosen by the Teleport maintainers.

For example, given a standalone/non-AD desktop such as:

windows_desktop_service:
  static_hosts:
    - name: ho1
      ad: false
      addr: 192.168.10.61
      labels:
        datacenter: win-11

when the user opens ho1 in Windows Desktop Access, that browser tab could show a Windows/desktop-specific favicon while the rest of the Teleport Web UI continues to use the normal Teleport favicon.

An illustrative API only might look like:

labels:
  teleport.favicon: windows

but the exact API and implementation are intentionally left to the maintainers.

What problem does this solve?

When several Teleport resources or sessions are open in browser tabs, Windows Desktop Access sessions are difficult to distinguish because they use the same Teleport favicon as the main Web UI.

A per-desktop/session favicon would make active desktop sessions immediately identifiable in the browser tab bar and would be especially useful when multiple desktops are open simultaneously.

This is also useful for self-hosted/Community deployments exposing standalone/non-AD Windows machines through Windows Desktop Access.

Expected behavior

• Teleport keeps its existing global favicon by default.
• Opening a Windows Desktop session with no favicon override behaves exactly as it does today.
• A Windows Desktop resource with a supported favicon/icon setting can change the browser-tab favicon for that desktop session only.
• Other Teleport pages and other desktop sessions remain unaffected.
• Unknown/invalid values safely fall back to the normal Teleport favicon.
• Ideally the mechanism works for both AD-joined and non-AD Windows desktops.
• No custom Teleport Web UI build or Docker image should be required.

Environment

Observed with Teleport Community/self-hosted v18.3.1 running in Docker.