feat(browser): keep sessions alive during desktop, takeover and agent use (AG-4)

camofox reaps a tab after TAB_INACTIVITY_MS (5 min) without API tool calls;
desktop-mode input goes straight to Selkies and screenshots don't count, so
tabs disappeared under the user during takeover.

- BrowserKeepalive (in-process): sessions held by an open desktop WebSocket
  (ref-counted), a human takeover lease, or a running/queued agent run that
  used browser.* get a keepalive every BROWSER_KEEPALIVE_MS (default 120s,
  0 = off). Holds are re-checked each round; release/lease expiry/agent end/
  session close stop it and camofox reaps as usual.
- Keepalive call: camofox 1.17 has no keepalive/touch endpoint and /stats does
  not bump toolCalls; use GET /tabs/{id}/downloads without includeData/consume
  (read-only metadata). Goes through BrowserService.run so restarts or reaped
  tabs self-heal via BR-3 reconnect; no lastAutomationAt, no control needed.
- Runbook browser.md §12, deploy env table, compose env; tests against the
  testkit mock camofox.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/server/src/modules/desktop/index.ts

@@ -1,3 +1,4 @@
+import { browserServiceFor } from "../browser/index.ts";
 import type { ServerContext, ServerModule } from "../types.ts";
 import { dbSessionChecks, desktopUpstream, registerDesktopRoutes } from "./desktop.ts";
 
@@ -18,6 +19,8 @@ export function createDesktopModule(): ServerModule {
         }),
         accessKey: ctx.config?.BROWSER_ACCESS_KEY ?? null,
         ...dbSessionChecks(ctx.db),
+        // 桌面连接期间保活浏览器会话(AG-4):人在桌面里的操作不经 camofox API,不保活会被空闲 5 分钟回收
+        onConnect: (sessionId) => browserServiceFor(ctx)?.keepalive.hold(sessionId, "desktop", "desktop") ?? (() => {}),
         log: (msg, extra) => ctx.logger.warn({ component: "desktop", ...extra }, msg),
       });
       closeAll = r.closeAll;