Port the WebMCP browser bridge into Labby

[jmagar]

Summary

• add a Rust-native browser bridge runtime with SQLite identity/session persistence, Ed25519 pairing, authenticated WebSockets, bounded invocation routing, cancellation, and stale-document enforcement
• port the Manifest V3 extension to Labby's versioned JSON bridge protocol
• add the complete browser operator lifecycle to the existing Next.js/Aurora console at /browsers
• register browser actions across shared dispatch, MCP, and authenticated HTTP API surfaces and regenerate catalogs

Safety

• WebSocket connections require loopback peers and browser-extension origins
• discovered page data is sanitized and bounded
• page execution begins disabled and requires explicit exact-session enablement
• revocation closes active sessions and live calls; replaced sockets cannot disconnect their successor

Verification

• cargo test -p labby-browser
• cargo clippy -p labby-browser -p labby --all-features --all-targets -- -D warnings
• npm test --prefix apps/browser-extension
• npm run typecheck --prefix apps/browser-extension
• pnpm lint
• pnpm exec tsc --noEmit
• pnpm test (499 unit tests plus installer tests)
• dedicated Playwright browser approval/consent flow
• pnpm build (static /browsers export)
• just docs-check