feat(browser): ship camofox v1.17.0 in compose, verified on a real instance

- compose: camofox service on by default (internal only, volume umt-camofox,
  healthcheck, CAMOFOX_REPLICAS=0 to skip); app depends on it with
  service_started/required=false and auto-registers camofox-env from
  BROWSER_PROVIDER_URL / BROWSER_ACCESS_KEY / BROWSER_ENABLED
- docker/camofox/Dockerfile: builds upstream tag v1.17.0 (389c996); fixes the
  upstream Dockerfile (missing postinstall.js before npm ci, sh -c not
  forwarding SIGTERM so logins were never persisted on restart)
- adapter fixes from the real container: coordinate click via evaluate +
  selector, focus typing with mode=keyboard, password values redacted from
  ARIA snapshots/extract, downloads field names, 410 after browser restart
  treated as lost tab; navigate reopens a tab in the same session
- verified-capability table keyed by upstream version (1.17.0 all ten);
  other versions stay unverified; probe reports auth failures
- settings: browser providers block (create/edit/delete/probe, capability
  table); API POST/PATCH/DELETE /browser/providers, POST .../probe
- scripts/browser-verify: umtbr stack + mock NexusPHP run of REQ 4.7.4 items
- docs: runbook browser §1/§7 (real-instance record), deploy §2.1

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/contracts/src/api.ts

@@ -2184,6 +2184,14 @@ export const Api = {
       body: browser.BrowserProviderUpdate,
       response: browser.BrowserProviderView,
     }),
+    deleteProvider: ep({
+      method: "delete",
+      path: "/browser/providers/{id}",
+      scope: "admin",
+      summary: "删除浏览器服务（有未关闭会话或由环境变量登记时拒绝）",
+      params: browser.BrowserProviderParams,
+      response: z.object({ id: z.string() }),
+    }),
     probeProvider: ep({
       method: "post",
       path: "/browser/providers/{id}/probe",

packages/contracts/src/settings.ts

@@ -553,9 +553,12 @@ export const SETTINGS_SECTIONS: readonly SettingsSectionDef[] = [
   {
     id: "sites",
     label: "站点默认",
-    description: "新站点的限流、快照周期、UA 和代理；站点和凭证在站点页管理",
+    description: "新站点的限流、快照周期、UA 和代理，以及原站视图用的浏览器服务；站点和凭证在站点页管理",
     legacyTabs: [{ tab: "site-credentials" }],
-    anchors: [{ id: "defaults", label: "站点默认" }],
+    anchors: [
+      { id: "defaults", label: "站点默认" },
+      { id: "browser", label: "浏览器服务" },
+    ],
     fields: [
       "sites.defaultRateLimit",
       "sites.defaultSnapshotIntervalSec",