feat(devtools): add optional Elements / Console / Network tools (Chrome DevTools Protocol)

[graydovee]

概述 / Summary

Adds an optional developer-tools group: inspect and edit element styles, run JS in the page, and capture network requests. Off by default; requires separate authorization. Closes #114.

• 81eb4cd implementation (20 files)
• 9d4d2e4 tests and docs (21 files)

动机 / Motivation

See #114. The existing tools cannot read computed styles or layout information, so style-related questions dead-end.

改动内容 / Changes

Host side (bridge-browser):

• hello gains a devTools capability negotiation: the group is registered only after the extension advertises it, and retracted on reconnect if the capability disappears
• 9 new tools: browser_devtools_elements (inspect elements), browser_devtools_set_element_style / browser_devtools_set_element_attribute (edit styles and attributes), browser_console_eval / browser_console_logs (run JS, read the console), browser_devtools_network / browser_devtools_list_requests / browser_devtools_get_request / browser_devtools_request_body (network capture); output remains { text }

Extension side (dsh-browser):

• chrome.debugger session management: attach, domain enable, timeouts, and a clear error on conflicts asking to close DevTools
• Elements: locate by selector or snapshot index; return computed styles, box model, and matched rules; edit inline styles or matched style rules
• Console: Runtime.evaluate runs JS and returns the result; console output and exceptions are recorded
• Network: requests recorded from CDP network events, with headers, status, timing, and response bodies
• Authorization: a dedicated approval dialog; a new "allow developer tools" setting; toggling it off detaches the debugger immediately
• The Chrome manifest gains the debugger permission; the Firefox manifest does not

Two implementation notes:

1. Network capture cannot listen to Network.requestWillBeSent alone: on some pages Chrome emits only requestWillBeSentExtraInfo and never the main event, leaving the capture empty. Both events now create entries, and entries missing the main event are annotated "request method may be incomplete".
2. In element reports, when a rule carries both a shorthand and its longhands, only the shorthand is kept; editing one longhand (e.g. margin-top) replaces the whole margin family, otherwise the shorthand would override the edit.

测试 / Testing

• pnpm run check:runtime
• pnpm run typecheck
• pnpm run test: bridge 160/160, extension 494/494
• pnpm run build
• pnpm run test:smoke

New tests cover: debugger session lifecycle, network-capture event handling (including the ExtraInfo case), element location and style edits, authorization policy ("full browser control" and the origin allowlist never cover this group), and the manifest platform differences.

Verified in Chrome: inspecting an element's computed styles and matched rules; adding an outline and re-reading it to confirm the style attribute was written; running JS in the console and reading back JSON plus an uncaught exception with its stack; capturing a fetch with status, headers, timing, and a formatted JSON body.

影响范围 / Impact

• The group is Chrome-only; it is not registered on Firefox
• Off by default: without the setting or a per-call approval there is no behavior change
• While the debugger is attached, the browser's own DevTools cannot open on the same tab
• No new dependencies; wire protocol unchanged

Checklist

• 已在相关平台实测通过 / Tested on the relevant platforms
• 已通过 pnpm run build / bash -n scripts/install.sh 等基础检查 / Passed basic checks
• 文档已同步更新（如需要）/ Docs updated if needed
• 不包含无关改动 / No unrelated changes included