feat(docker): browser desktop image (Selkies Wayland + headed camofox) and optional TLS proxy

Selkies baseimage (debiantrixie, digest-pinned) with camofox 1.17.0 copied
from camofox-browser:1.17.0, run headed under labwc so the desktop shows the
same Firefox the agent drives. s6 service waits for wayland-0 and depends on
svc-de and svc-dbus so shutdown persists login state. Selkies control/view
passwords derive from CAMOFOX_ACCESS_KEY. Compose defaults to the new image;
CAMOFOX_IMAGE=camofox-browser:1.17.0 switches back. Optional caddy (profile tls).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docker/browser-desktop/Caddyfile

@@ -0,0 +1,20 @@
+# 可选 HTTPS 入口(docker-compose.yml 的 caddy 服务,profile tls;docs/runbook/browser.md §8.4)。
+# 桌面模式的视频解码(WebCodecs)与剪贴板只在安全上下文(HTTPS 或 localhost)可用。
+#   TLS_DOMAIN 未设:自签(Caddy 内部 CA,按访问的主机名 / IP 现场签发),浏览器需手动放行或导入根证书
+#                    (容器内 /data/caddy/pki/authorities/local/root.crt)
+#   TLS_DOMAIN=media.example.com + [email protected]:ACME 自动申请(80/443 需公网可达)
+# TLS_UPSTREAM:反代目标,缺省 app:4380(app 不在同一 compose 网络时改)
+{
+	auto_https disable_redirects
+}
+
+{$TLS_DOMAIN:https://} {
+	tls {$TLS_ISSUER:internal} {
+		on_demand
+	}
+	encode zstd gzip
+	reverse_proxy {$TLS_UPSTREAM:app:4380} {
+		# SSE 与桌面 WebSocket 不缓冲
+		flush_interval -1
+	}
+}