feat(browser): ship camofox v1.17.0 in compose, verified on a real instance

- compose: camofox service on by default (internal only, volume umt-camofox,
  healthcheck, CAMOFOX_REPLICAS=0 to skip); app depends on it with
  service_started/required=false and auto-registers camofox-env from
  BROWSER_PROVIDER_URL / BROWSER_ACCESS_KEY / BROWSER_ENABLED
- docker/camofox/Dockerfile: builds upstream tag v1.17.0 (389c996); fixes the
  upstream Dockerfile (missing postinstall.js before npm ci, sh -c not
  forwarding SIGTERM so logins were never persisted on restart)
- adapter fixes from the real container: coordinate click via evaluate +
  selector, focus typing with mode=keyboard, password values redacted from
  ARIA snapshots/extract, downloads field names, 410 after browser restart
  treated as lost tab; navigate reopens a tab in the same session
- verified-capability table keyed by upstream version (1.17.0 all ten);
  other versions stay unverified; probe reports auth failures
- settings: browser providers block (create/edit/delete/probe, capability
  table); API POST/PATCH/DELETE /browser/providers, POST .../probe
- scripts/browser-verify: umtbr stack + mock NexusPHP run of REQ 4.7.4 items
- docs: runbook browser §1/§7 (real-instance record), deploy §2.1

Co-Authored-By: Claude Opus 5.5 <[email protected]>

scripts/browser-verify/compose.yml

@@ -0,0 +1,20 @@
+# 真机核验用的 compose 覆盖(只起 postgres + camofox + mocknexus,不起 app;项目名 umtbr,与正式 umt 栈隔离)。
+# 用法见 run.sh。
+services:
+  postgres:
+    ports:
+      - "127.0.0.1:55447:5432"
+  camofox:
+    # 核验脚本在宿主上跑,需要直连;正式部署不映射端口
+    ports:
+      - "127.0.0.1:49377:9377"
+  mocknexus:
+    image: denoland/deno:2.9.7
+    working_dir: /repo
+    command: ["run", "--no-config", "--no-lock", "-A", "scripts/browser-verify/mock-site.ts"]
+    volumes:
+      # 相对路径按项目目录(第一个 -f 文件所在的仓库根)解析
+      - ./:/repo:ro
+    ports:
+      - "127.0.0.1:48080:8080"
+      - "127.0.0.1:48081:8081"