fix(mcp): guard shared playwright browser

[skulidropek]

Summary

• add a guarded CDP proxy in the Playwright browser sidecar to block Browser.close/crash requests from MCP
• keep Playwright MCP pointed at a stable guarded HTTP CDP endpoint instead of a stale browser websocket id
• wire guard env defaults/docs and add template/usecase coverage

Validation

• git diff --check
• bun run --cwd packages/lib test -- tests/usecases/mcp-playwright.test.ts tests/core/templates.test.ts tests/usecases/prepare-files.test.ts
• bun run --cwd packages/app test -- tests/docker-git/actions-browser.test.ts tests/docker-git/app-ready-browser-openable.test.ts tests/docker-git/parser.test.ts
• bun run --cwd packages/lib typecheck
• bun run --cwd packages/app typecheck
• bun run --cwd packages/lib lint
• bun run --cwd packages/app lint

Notes

• existing projects need their browser sidecar rebuilt/restarted to pick up the generated Dockerfile.browser guard
• MCP_PLAYWRIGHT_CDP_GUARD=0 and MCP_PLAYWRIGHT_BLOCK_BROWSER_CLOSE=0 remain escape hatches