feat(browser): self-heal sessions after camofox restarts (BR-3)

- Any session operation that hits 404/410 (or finds no open tab) reconciles
  tabs; if none survive it re-injects the account cookies (BR-2), opens a new
  tab under the same userId/sessionKey, returns to the recorded URL (site home
  otherwise), marks old tabs lost and retries the operation once. Failure
  returns 503 browser_reconnect_failed with the reason, with a 10s backoff.
- Restart detection: umt plugin GET /umt/instance (fallback /health fields);
  a changed instance id marks every open session needsReconnect.
- POST /browser/sessions/{id}/reconnect (idempotent); session view exposes
  needsReconnect and reconnect {status, trigger, at, reason, humanNotice}.
- Controller and lease are kept; reconnecting during takeover asks the human
  to double-check the reloaded page.
- Web: screenshot and desktop modes show "reconnecting", auto-reconnect once,
  pause polling, offer a reconnect button with the reason on failure; desktop
  mode rebuilds the Selkies connection after a reconnect.
- Mock camofox restart(), tests, smoke step and runbook section 10.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/web/app/api/browser.ts

@@ -128,6 +128,16 @@ export function useCloseBrowserSession(siteId: string) {
   });
 }
 
+/** BR-3:浏览器服务重启后重新连接(幂等;上游上下文还在时服务端什么都不做) */
+export function useBrowserReconnect(siteId: string) {
+  const refresh = useRefresh(siteId);
+  return useMutation({
+    mutationFn: (id: string) =>
+      apiData<BrowserSessionView>("/browser/sessions/{id}/reconnect", { method: "POST", pathParams: { id }, body: {} }),
+    onSuccess: (s) => refresh(s),
+  });
+}
+
 export function useBrowserControl(siteId: string) {
   const refresh = useRefresh(siteId);
   const acquire = useMutation({