feat(browser): ship camofox v1.17.0 in compose, verified on a real instance

- compose: camofox service on by default (internal only, volume umt-camofox,
  healthcheck, CAMOFOX_REPLICAS=0 to skip); app depends on it with
  service_started/required=false and auto-registers camofox-env from
  BROWSER_PROVIDER_URL / BROWSER_ACCESS_KEY / BROWSER_ENABLED
- docker/camofox/Dockerfile: builds upstream tag v1.17.0 (389c996); fixes the
  upstream Dockerfile (missing postinstall.js before npm ci, sh -c not
  forwarding SIGTERM so logins were never persisted on restart)
- adapter fixes from the real container: coordinate click via evaluate +
  selector, focus typing with mode=keyboard, password values redacted from
  ARIA snapshots/extract, downloads field names, 410 after browser restart
  treated as lost tab; navigate reopens a tab in the same session
- verified-capability table keyed by upstream version (1.17.0 all ten);
  other versions stay unverified; probe reports auth failures
- settings: browser providers block (create/edit/delete/probe, capability
  table); API POST/PATCH/DELETE /browser/providers, POST .../probe
- scripts/browser-verify: umtbr stack + mock NexusPHP run of REQ 4.7.4 items
- docs: runbook browser §1/§7 (real-instance record), deploy §2.1

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/web/app/components/browser/site-origin-view.tsx

@@ -103,7 +103,9 @@ export function SiteOriginView({ site }: { site: SiteListItem }) {
     );
 
   const caps = provider.capabilities;
-  const unverified = !caps?.takeover.verified || !caps?.screenshot.verified;
+  // 上游缺端点 → 不可用;有端点但没有真机核验记录 → 未核验(REQ §4.7.4)
+  const unsupported = !!caps && (!caps.takeover.supported || !caps.screenshot.supported);
+  const unverified = !unsupported && (!caps?.takeover.verified || !caps?.screenshot.verified);
   const conn: { tone: StatusTone; text: string } = paused
     ? { tone: "neutral", text: "已暂停刷新" }
     : shot.isError
@@ -147,6 +149,7 @@ export function SiteOriginView({ site }: { site: SiteListItem }) {
           {human && leaseHolder ? `(${leaseHolder})` : ""}
         </StatusBadge>
         {waiting ? <StatusBadge tone="warning">{waiting}</StatusBadge> : null}
+        {unsupported ? <StatusBadge tone="destructive">该浏览器服务不支持画面与输入</StatusBadge> : null}
         {unverified ? <StatusBadge tone="warning">画面与输入未对真实实例核验</StatusBadge> : null}
         <div className="ml-auto flex flex-wrap items-center gap-2">
           {human ? (