feat(browser): self-heal sessions after camofox restarts (BR-3)

- Any session operation that hits 404/410 (or finds no open tab) reconciles
  tabs; if none survive it re-injects the account cookies (BR-2), opens a new
  tab under the same userId/sessionKey, returns to the recorded URL (site home
  otherwise), marks old tabs lost and retries the operation once. Failure
  returns 503 browser_reconnect_failed with the reason, with a 10s backoff.
- Restart detection: umt plugin GET /umt/instance (fallback /health fields);
  a changed instance id marks every open session needsReconnect.
- POST /browser/sessions/{id}/reconnect (idempotent); session view exposes
  needsReconnect and reconnect {status, trigger, at, reason, humanNotice}.
- Controller and lease are kept; reconnecting during takeover asks the human
  to double-check the reloaded page.
- Web: screenshot and desktop modes show "reconnecting", auto-reconnect once,
  pause polling, offer a reconnect button with the reason on failure; desktop
  mode rebuilds the Selkies connection after a reconnect.
- Mock camofox restart(), tests, smoke step and runbook section 10.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/contracts/src/common.ts

@@ -35,6 +35,7 @@ export const ApiErrorCode = z.enum([
   "rate_limited",
   "automation_disabled",
   "upstream_unavailable",
+  "browser_reconnect_failed",
   "internal",
 ]);
 export type ApiErrorCode = z.infer<typeof ApiErrorCode>;
@@ -51,6 +52,8 @@ export const API_ERROR_STATUS = {
   rate_limited: 429,
   automation_disabled: 423,
   upstream_unavailable: 502,
+  /** 浏览器服务重启后自动重连失败(BR-3):浏览器服务暂不可用,稍后重试 */
+  browser_reconnect_failed: 503,
   internal: 500,
 } as const satisfies Record<ApiErrorCode, number>;