[httpsphl]

Builds on #138 (its commit shows here until that one merges).

Google, and other sites that look past the user agent and navigator.webdriver, refuse to sign in to the bot's browser ("This browser or app may not be secure"). That happens even with the owner in control, because the browser is still a headless Edge driven over DevTools. This PR adds a way around it that hides nothing from the site: the owner signs in to the bot's profile in a real Edge window.

Daemon

• New browser.window {botId}: it closes the headless browser, then starts the same browser with a window, on the same profile, without --remote-debugging-port and on the page the bot was on (browser/window.rs, launch::window). It runs in its own job, so it dies with the daemon.
• While the window is open, BrowserState.window is true (status closed, control owner), and the bot's tools wait as they do for the owner's hands. browser.list includes the browser. Pausing the bot does not close the window; archiving it kills the window.
• When the window closes, the browser goes back to the bot. An open browser_ask_owner request is answered Done, and the tool tells the bot to browser_open again because the logins stay.

App

• Sign in in a window sits next to Take control under the live screen, in the help callout and in the "You are in control" bar. While the window is open, a bar reads "Open in a window" and tells the owner to sign in there and then close it.
• Texts are in en, pt-BR and es. FakeBotloft supports it. New window.test.tsx.

Measured with Edge 154 (recorded in spec 19): a msedge.exe started with --user-data-dir and no DevTools stays alive as the browser itself and exits a few seconds after its window closes. A cookie set in the window shows up in the headless Edge opened later on the same profile.

Spec: new 21.11 (old 21.11 Marcos becomes 21.12, with the N3.4 milestone), plus updates to 21.7 and 21.3.

Checks: cargo fmt, clippy and the full test suite (twice), and pnpm check. I also checked the panel in the dev preview.

lib/fakeBrowser.ts is now 324 lines, a little over the ~300 guideline.

Manual test with real Claude Code

1. Ask a bot to open gmail.com in its browser. When it reaches the Google sign-in page, click Sign in in a window in the panel.
2. An Edge window opens on that page. Sign in, then close the window.
3. The panel goes back to normal. Ask the bot to open Gmail: it should already be signed in.
4. Repeat with the bot asking through browser_ask_owner: closing the window should mark the request Done, and the bot should reopen the page.