feat(docker): browser desktop image (Selkies Wayland + headed camofox) and optional TLS proxy

Selkies baseimage (debiantrixie, digest-pinned) with camofox 1.17.0 copied
from camofox-browser:1.17.0, run headed under labwc so the desktop shows the
same Firefox the agent drives. s6 service waits for wayland-0 and depends on
svc-de and svc-dbus so shutdown persists login state. Selkies control/view
passwords derive from CAMOFOX_ACCESS_KEY. Compose defaults to the new image;
CAMOFOX_IMAGE=camofox-browser:1.17.0 switches back. Optional caddy (profile tls).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docker/compose.env.example

@@ -29,7 +29,8 @@ LOG_LEVEL=info
 
 # ── 浏览器服务(camofox-browser,原站视图 / Agent 浏览器能力;docs/runbook/browser.md)──
 # 缺省随 compose 起一个 camofox 容器(只在内网,不映射端口),app 自动登记为 camofox-env。
-# 访问凭据:camofox 与 app 共用;建议设置(openssl rand -hex 24)
+# 缺省镜像是浏览器桌面(原站视图桌面模式,docker/browser-desktop);要先有 camofox-browser:1.17.0(runbook browser.md §1.1)。
+# 访问凭据:camofox 与 app 共用;建议设置(openssl rand -hex 24)。桌面模式的控制 / 只读口令也由它派生,不设则桌面模式不可用
 CAMOFOX_ACCESS_KEY=
 # 接自有 camofox 实例:改成它的地址与凭据,并把 CAMOFOX_REPLICAS 设 0
 # BROWSER_PROVIDER_URL=http://camofox:9377
@@ -41,6 +42,29 @@ CAMOFOX_ACCESS_KEY=
 # CAMOFOX_SESSION_TIMEOUT_MS=1800000
 # CAMOFOX_BROWSER_IDLE_TIMEOUT_MS=300000
 # CAMOFOX_MAX_SESSIONS=8
-# CAMOFOX_MEM_LIMIT=2g
+# CAMOFOX_MEM_LIMIT=3g
 # CAMOFOX_LOCALE=zh-CN
 # CAMOFOX_TIMEZONE=Asia/Shanghai
+
+# ── 原站视图桌面模式(docs/runbook/browser.md §8)──
+# 只要截图模式:改回纯截图镜像(同一个卷,登录状态通用)
+# CAMOFOX_IMAGE=camofox-browser:1.17.0
+# 桌面分辨率与帧率(纯 CPU 编码,持续滚动约占 1 核)
+# BROWSER_DESKTOP_WIDTH=1280
+# BROWSER_DESKTOP_HEIGHT=900
+# BROWSER_DESKTOP_FRAMERATE=24,8-30
+# 容器内输入法(备选;缺省用访问者本机输入法):fcitx5
+# BROWSER_DESKTOP_IME=
+# 桌面浏览器进程的运行用户
+# CAMOFOX_PUID=1000
+# CAMOFOX_PGID=1000
+# 桌面上游地址(缺省由 BROWSER_PROVIDER_URL 推出,端口换 3000)
+# BROWSER_DESKTOP_URL=http://camofox:3000
+
+# ── HTTPS(可选,compose profile tls;桌面模式的视频解码与剪贴板需要 HTTPS)──
+# docker compose --profile tls up -d
+# 不设 TLS_DOMAIN = 自签(Caddy 内部 CA);设域名 + TLS_ISSUER=邮箱 = ACME 自动证书
+# TLS_DOMAIN=media.example.com
+# [email protected]
+# TLS_PORT=443
+# TLS_BIND=0.0.0.0