feat(browser): ship camofox v1.17.0 in compose, verified on a real instance

- compose: camofox service on by default (internal only, volume umt-camofox,
  healthcheck, CAMOFOX_REPLICAS=0 to skip); app depends on it with
  service_started/required=false and auto-registers camofox-env from
  BROWSER_PROVIDER_URL / BROWSER_ACCESS_KEY / BROWSER_ENABLED
- docker/camofox/Dockerfile: builds upstream tag v1.17.0 (389c996); fixes the
  upstream Dockerfile (missing postinstall.js before npm ci, sh -c not
  forwarding SIGTERM so logins were never persisted on restart)
- adapter fixes from the real container: coordinate click via evaluate +
  selector, focus typing with mode=keyboard, password values redacted from
  ARIA snapshots/extract, downloads field names, 410 after browser restart
  treated as lost tab; navigate reopens a tab in the same session
- verified-capability table keyed by upstream version (1.17.0 all ten);
  other versions stay unverified; probe reports auth failures
- settings: browser providers block (create/edit/delete/probe, capability
  table); API POST/PATCH/DELETE /browser/providers, POST .../probe
- scripts/browser-verify: umtbr stack + mock NexusPHP run of REQ 4.7.4 items
- docs: runbook browser §1/§7 (real-instance record), deploy §2.1

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/web/app/api/browser.ts

@@ -3,6 +3,8 @@ import type {
   BrowserActionResult,
   BrowserControlResult,
   BrowserNavigation,
+  BrowserProviderCreate,
+  BrowserProviderUpdate,
   BrowserProviderView,
   BrowserScreenshotView,
   BrowserSessionView,
@@ -23,6 +25,50 @@ export function useBrowserProviders() {
   });
 }
 
+// ── 设置页:浏览器服务登记 / 修改 / 删除 / 测试连通 ──
+
+function useInvalidateProviders() {
+  const qc = useQueryClient();
+  return () => qc.invalidateQueries({ queryKey: qk.list(AREA, { kind: "providers" }) });
+}
+
+export function useCreateBrowserProvider() {
+  const invalidate = useInvalidateProviders();
+  return useMutation({
+    mutationFn: (body: BrowserProviderCreate) =>
+      apiData<BrowserProviderView>("/browser/providers", { method: "POST", body }),
+    onSuccess: invalidate,
+  });
+}
+
+export function useUpdateBrowserProvider() {
+  const invalidate = useInvalidateProviders();
+  return useMutation({
+    mutationFn: ({ id, body }: { id: string; body: BrowserProviderUpdate }) =>
+      apiData<BrowserProviderView>("/browser/providers/{id}", { method: "PATCH", pathParams: { id }, body }),
+    onSuccess: invalidate,
+  });
+}
+
+export function useDeleteBrowserProvider() {
+  const invalidate = useInvalidateProviders();
+  return useMutation({
+    mutationFn: (id: string) =>
+      apiData<{ id: string }>("/browser/providers/{id}", { method: "DELETE", pathParams: { id } }),
+    onSuccess: invalidate,
+  });
+}
+
+/** 测试连通:探测 /health 与 /openapi.json 并写回能力 */
+export function useProbeBrowserProvider() {
+  const invalidate = useInvalidateProviders();
+  return useMutation({
+    mutationFn: (id: string) =>
+      apiData<BrowserProviderView>("/browser/providers/{id}/probe", { method: "POST", pathParams: { id }, body: {} }),
+    onSuccess: invalidate,
+  });
+}
+
 /** 站点的未关闭会话(最新的一个) */
 export function useSiteBrowserSession(siteId: string, enabled = true) {
   return useQuery({