Test runner hardening and code quality fixes

[joyzoursky]

• Security
  • Add runtime SSRF checks.
  • Block DNS rebinding and unsafe redirects.
  • Restrict setInputFiles to test-case uploads.
  • Support step allowlist when provided.
  • Isolate Midscene/OpenRouter API keys per run.
• Playwright code execution
  • Harden VM execution.
  • Disable VM string/wasm codegen.
  • Add statement + sync timeouts.
  • Track and clean up timers.
• Credentials
  • Fix credential propagation to the right browser target.
  • Clarify credential usage via placeholders and variables.
• Reliability
  • Improve abort handling.
  • Improve error traceability.
  • Fix screenshot MIME and JPEG quality handling.
• Developer/UX hygiene
  • Fix TS + ESLint issues.
  • Add a builder-level credential helper box.
  • Update sample data to use placeholders.
  • Reorder .gitignore / .claudeignore.
  • Remove outdated plan docs.