fix(browser-capture): stop silently elevating CA install/uninstall

[ZYKJShadow]

Summary

The Windows CA installer used to fall through from a user-store certutil call to a UAC-elevated machine-store call whenever the first attempt returned a non-zero exit code — including the case where the user just clicked "No" on Windows' standard root-trust dialog. Combined with a 2.5–6 s poll of proxyCaRefresh that could flip the install/uninstall toggle, users reported a surprise "asks to install, then asks to uninstall" sequence with multiple system prompts per click.

This PR removes the silent elevation, distinguishes "cert not in this store" from "command failed", throttles the polling, and adds a confirm dialog so a stale toggle state can never silently invoke the system trust prompt.

• main-src/browser/browserCaInstaller.ts
  • install / uninstall now take an explicit scope: 'user' | 'machine'. They never auto-escalate.
  • macOS user-scope install uses the login keychain (no sudo); only machine scope goes through sudo-prompt.
  • Linux uninstall short-circuits when the cert file is absent.
  • Windows uninstall checks the relevant store first; if the cert isn't there, it returns successfully without spawning certutil and (for machine) without triggering UAC.
• main-src/ipc/handlers/browserHandlers.ts
  • browserCapture:proxyCaInstall / proxyCaUninstall now accept { scope } (defaults to user).
• src/AgentBrowserWindowSurface.tsx
  • The proxyCaRefresh poller now runs only while the proxy is actively running and at a 15 s cadence (was 2.5 s while running, 6 s while idle).
  • The install/uninstall button shows a window.confirm with localized copy before invoking the IPC.
• src/i18n/messages.{en,zh-CN}.ts
  • New copy: browserCaptureCaInstallConfirm, browserCaptureCaInstallMachineConfirm, browserCaptureCaUninstallConfirm, browserCaptureCaInstallMachine.

Test plan

• Windows: open the agent browser, start the capture proxy, click Install CA — confirm only one Windows root-trust prompt appears, no UAC.
• Windows: with the CA installed in the user store, click Uninstall — verify it removes silently, no UAC.
• Windows: with the CA NOT installed anywhere, click Uninstall — verify the call returns ok without spawning certutil and without UAC.
• macOS: Install CA in user scope writes to the login keychain without a sudo prompt; Uninstall removes it.
• Linux: Install/Uninstall still work via sudo-prompt; uninstall on a fresh system is a no-op.
• Confirm the per-15 s proxyCaRefresh poll only runs while the proxy is up; closing the proxy stops the timer.
• Cancel button on the confirm dialog cancels the operation cleanly (no IPC sent).

🤖 Generated with Claude Code