fix(browse): stop health auth token exposure

[maxpetrusenkoagent]

Summary

• make /health public status-only so spoofed chrome-extension:// origins never receive the root auth token
• provision the bundled extension auth token through chrome.storage.local instead of /health
• pin terminal-agent WebSocket origin checks to the detected bundled gstack extension ID

Test Plan

• bun test browse/test/server-auth.test.ts browse/test/extension-auth-bootstrap.test.ts browse/test/terminal-agent-integration.test.ts browse/test/pair-agent-e2e.test.ts browse/test/sidebar-tabs.test.ts

Fixes #1324

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[maxpetrusenkoagent]

Review-fix sweep update:

Resolved the merge conflict against current upstream garrytan/gstack:main and pushed a fast-forward update to the PR branch.

Conflict resolution:

• Kept the PR intent: extension auth is provisioned through trusted extension chrome.storage.local, not /health.
• Kept current main behavior: shared applyStealth Layer C cleanup remains active for the headed launch path.
• Verified final PR diff against upstream base with git fetch https://github.com/garrytan/gstack.git main + git diff FETCH_HEAD...HEAD --stat: focused on the same 10 intended PR files.

Verification:

• bun test browse/test/extension-auth-bootstrap.test.ts browse/test/server-auth.test.ts browse/test/terminal-agent-integration.test.ts -> 55 pass, 0 fail
• git diff --name-only --diff-filter=U -> no unresolved conflicts
• GitHub now reports mergeable=MERGEABLE; no checks are currently reported on the branch.

Second-agent note:

• Tried claude -p; it produced no output before timeout.
• Tried fresh hermes chat -Q; it produced no output before timeout.
• Tried Oracle fallback; local environment lacked OPENAI_API_KEY for API mode.

Confidence: high on the conflict repair. Remaining state is GitHub/check settling, not a local merge conflict.