Add trusted browser relay client

[Mathieu2301]

Summary

• add an isolated miakapi/browser entry point backed by the native WebSocket API
• implement role-1 authentication, same-socket reauthentication, immutable state synchronization, home availability, and non-replayed named calls
• add deterministic lifecycle, protocol, race, cleanup, resource-budget, bundle-isolation, and public-contract coverage
• provide a synthetic browser fixture for the relay's real Chromium integration gate

Security boundary

This profile sends the Firebase ID-token bearer to the configured relay. It is therefore restricted to official or explicitly fully trusted relays. Product wiring to arbitrary relays remains blocked until the control plane can issue short-lived credentials scoped to the relay, home, user, and role. The integration fixture contains synthetic credentials only.

Native WebSocket messages are allocated before JavaScript can reject them. Per-frame and rolling inbound limits are defense in depth; official relay/proxy enforcement remains required.

Validation

• bun run check
• 115 tests / 383 assertions
• strict typecheck and production build
• Node and browser-bundle smoke tests
• 11-scenario canonical SDK conformance
• npm package dry run
• real Chromium/WSS relay integration against the Server worktree