feat(browser): click without indices, scroll inner containers, send modifiers, and add opt-in page tools

[youli42]

Problems

The browser surface addresses everything through snapshot indices and the window scroller, which leaves common pages readable but not operable:

• Pagination / JS-only controls are unclickable. The inventory whitelist (a[href], button, inputs, a few roles) skips <a> without href, <li onclick> rows and cursor:pointer cells; the 60-item cap then pushes bottom-of-page pagination out. The model sees "Next" in the text but has no index to click.
• Inner scroll containers cannot be scrolled. browser_scroll only moves the window, so app-shell layouts (body { overflow: hidden } plus an inner scrolling div) do not move at all.
• Modifier combinations are dropped. browser_press builds KeyboardEvent without modifier state, so page-level shortcuts such as Control+Enter are inexpressible.
• Page storage, page-origin requests and page JavaScript are unreachable. The extension already holds scripting and all-site host permissions, so this is a tool-contract gap, not a platform limit.
• The form-field cap is hardcoded at 30 in the content script with no negotiation path, so dense pages require hand-patching built bundles.

Changes

• browser_click accepts exactly one of index, selector, or text (plus role/nth); text resolution walks to the nearest actionable ancestor and reports ambiguity instead of guessing. Index addressing keeps its document-binding guard.
• browser_snapshot lists inner scroll containers with a unique selector, scroll percentage and remaining pixels; browser_scroll moves an addressed container.
• browser_press accepts modifiers.
• Opt-in (advancedTools: true, default off): browser_get_storage, browser_fetch, browser_eval. Approval-gated; bulk storage listings mask credential-looking values; fetch runs from the page origin; eval runs in the page main world and polls async results. Fetch/eval never receive persistent origin trust, and every payload crosses the untrusted-content boundary.
• maxForms is negotiated like the other two snapshot caps (protocol, plugin config, budget push, per-frame allocation).

Testing

• pnpm run typecheck and pnpm run build pass.
• Extension: 437 tests pass. Bridge: 151/152 — the one failure (token.spec, 0600 mode) is pre-existing on Windows and fails on a clean checkout too.
• New tests cover selector/text addressing and ambiguity, modifiers, inner-container scrolling, storage masking, fetch construction/CORS failure, main-world evaluation and polling, approval denial, and negotiated maxForms.

Known limits, documented in the READMEs: browser-reserved shortcuts and native editing defaults still need a CDP/debugger path; browser_eval is subject to page CSP and cannot preempt an infinite loop. The new eval path was unit-tested by executing the injected function directly, not smoke-tested in a real browser.