fedora-remote: open the RDP port in firewalld

firewalld only allows ssh by default, so GRD was listening on 3389 but the port
was still blocked. Allow the firewalld 'rdp' service in grd-firstboot.

images/fedora-remote/files/grd-firstboot

@@ -35,4 +35,10 @@ fi
 grdctl --system rdp enable
 systemctl restart gnome-remote-desktop.service || true
 
+# Open the RDP port in firewalld (best effort; firewalld may not be installed).
+if command -v firewall-cmd >/dev/null 2>&1; then
+  firewall-cmd --permanent --add-service=rdp >/dev/null 2>&1 || true
+  firewall-cmd --reload >/dev/null 2>&1 || true
+fi
+
 touch "${MARKER}"