feat(server): /v1/fetch endpoint backed by handler-owned browsers

[KeyCode17]

Summary

Adds a generic POST /v1/fetch proxy that runs a single HTTP request from inside the same browser session a Cloudflare/PerimeterX handler would have spawned for /v1/solve. Solves the JA3/UA cliff downstream Rust clients hit when replaying the cookie bundle: the response comes from the real Firefox so cookies, TLS ClientHello, and User-Agent are all consistent to the upstream WAF.

What's wired

• New Fetcher port trait in px-pipeline next to ChallengeHandler, with FetchRequest / FetchResponse value types.
• CamoufoxPool now implements Fetcher (in addition to Harvester). The new impl navigates to the target URL's origin, waits 1.5s for CF/PX to issue cookies, then executes a fetch() from the page context via execute_async, capturing status / headers / body.
• Both Harvester and Fetcher share CamoufoxPool::with_session, extracted alongside the shared caps helpers (pick_free_port, wait_for_geckodriver, build_capabilities, get_status).
• RoutingFetchDispatcher mirrors RoutingDispatcher: same DNS-suffix routing, no caching (each fetch spawns a fresh browser), per-route handler name echoed in the response so the API caller knows which path executed.
• New POST /v1/fetch axum route. Same Bearer-token auth and per-domain allowlist checks as /v1/solve, same record_audit log shape.
• New DTOs FetchRequestDto / FetchResponseDto.
• AppState/AppStateConfig gain a fetch_dispatcher field. Both dispatchers are now built together in bootstrap::dispatchers::build_dispatchers, which keeps main.rs under the 200-LOC rule and lets the shared CamoufoxPool back both the Harvester (solve) and Fetcher (fetch) traits via Arc::clone.
• Existing tests updated to populate the new field with an empty RoutingFetchDispatcher::new(None).

What's not wired

• No Fetcher impl on the Chromium pool yet — only CF-routed domains get /v1/fetch. Allowlisted-but-PX-only domains return Conflict("no fetcher configured for host ..."). A follow-up can add ChromiumoxidePool: impl Fetcher.
• No browser session reuse — every fetch spawns geckodriver + Camoufox + tears them down. That's ~13s on a warm machine. Pooling is an ADR-level decision; this PR keeps the v1 surface honest.

Why

Downstream Rust HTTP clients (rustls, libcurl, wreq with stock Firefox emulation) can't replay a cf_clearance cookie because Cloudflare's Bot Management binds the cookie to the TLS ClientHello of the browser that earned it. Camoufox's ClientHello is custom; no off-the-shelf Rust crate matches it exactly. The cleanest fix is to do the actual fetch inside the Camoufox session and return the response to the API caller, which is what /v1/fetch does.

This unblocks consumers like the pedidosya scraper that want to drive paginated XHRs against CF-fronted endpoints without inheriting the WAF arms race.

Test plan

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features against the lefthook rule set (-D warnings -D unwrap_used -D expect_used -D panic -D dbg_macro -D todo -D unimplemented)
• cargo test --workspace --lib — existing tests pass plus two new ones (routes_match_by_dns_suffix, returns_conflict_when_no_route_and_no_default) in fetch_endpoint::tests
• cargo test -p px-server — server.rs integration tests still pass after the AppStateConfig field addition
• Lefthook pre-commit + pre-push hooks green locally (fmt, clippy, loc-200, forbidden-patterns, tests)
• Manual canary against pedidosya.com.ar deferred to a follow-up commit once a downstream consumer (the pedidosya scraper) exercises the endpoint end-to-end

Files

px-pipeline/src/domain/fetcher.rs           NEW  Fetcher trait + value types
px-camoufox/src/infrastructure/caps.rs      NEW  Shared geckodriver helpers
px-camoufox/src/infrastructure/camoufox_pool.rs  with_session helper extracted
px-camoufox/src/infrastructure/camoufox_fetcher.rs  NEW  Fetcher impl
px-server/src/application/fetch_endpoint.rs       NEW  FetchDispatcher + tests
px-server/src/infrastructure/bootstrap/dispatchers.rs  NEW  build_dispatchers
px-server/src/infrastructure/http/handlers/fetch.rs    NEW  HTTP handler
px-server/src/infrastructure/http/dto.rs              FetchRequestDto/Response
px-server/src/infrastructure/bootstrap/{app_state,router}.rs  wire fetch_dispatcher
px-server/src/main.rs                                 collapse build_dispatcher() into bootstrap::dispatchers

🤖 Generated with Claude Code