feat(web): proxy project browsers over noVNC

[skulidropek]

Summary

• add API project browser proxy endpoints for noVNC and CDP browser access
• expose browser URLs/actions in the web UI so container browsers can be opened by URL
• bridge noVNC WebSocket traffic directly to VNC TCP to avoid the sidecar websockify hang
• keep web runtime proxying /b/*, /p/*, and websocket upgrade traffic correctly through tunnels

Verification

• git diff --check
• secret pattern scan for GitHub tokens/private keys in the diff
• bun run api:typecheck
• bun run api:test
• bun run --filter @prover-coder-ai/docker-git typecheck
• bun run --filter @prover-coder-ai/docker-git test
• bun run web:build

Runtime Proof

• public noVNC HTML and JS assets return 200
• wss://.../b/<project-key>/websockify completes RFB handshake: server banner RFB 003.008, security type 0101
• Chromium/CDP check reached noVNC_connected
• noVNC rendered a 1024x768 canvas and reported Connected (encrypted)

Mathematical Guarantees

Invariants

• For any valid project browser key, /b/<key>/* resolves to exactly one project browser target or fails closed.
• noVNC websocket traffic preserves byte order from client websocket frames to VNC TCP stream and back.
• Static app fallback does not intercept browser proxy paths: /api/*, /p/*, and /b/* are always proxied.

Preconditions

• Project has a running browser sidecar container with reachable VNC port 5900.
• The API process can inspect project metadata and reach the browser container network.

Postconditions

• Browser URL opens the target container browser through noVNC.
• CDP proxy URLs are externally rewritten for the current request origin.
• Web runtime supports the same browser URLs through Cloudflare tunnel and local proxy.