test(browser): use controlled fixtures for lifecycle and Docker suites

[Excelius-Wang]

What changed

Browser integration tests depend on third-party pages and download endpoints, making results sensitive to external content and availability. Replace them with controlled HTTP pages and a fixed PDF, retaining real Chromium, worker APIs, destination checks, downloads, and restart recovery. Follow-up to #90.

Share fixtures and API assertions between local process-restart and Docker tests. The Docker runner mounts a test-only entrypoint read-only into the normal image and retains its isolation flags, disposable profiles, and cleanup. Default production factories and network policy remain unchanged. Assert exact PDF bytes and recovered localStorage without reseeding or redownloading after restart; add regressions for fixture initialization and runner cleanup failures. Mark PDF fixtures as binary using the repository’s existing asset convention.

Verification

• pnpm test: 278 tests passed.
• pnpm test:browser: 2 real Chromium tests passed.
• pnpm lint, pnpm typecheck, and pnpm --dir apps/worker typecheck: passed.
• pnpm build:server, pnpm build:web, pnpm build:ios, and pnpm build:android: passed.
• node apps/worker/tests/run-docker.mjs: passed on Docker Desktop with a Linux ARM64 daemon (exit 0, 1/1 test). Verified actual container restart, PDF/storage recovery, isolation settings, and container/anonymous-volume cleanup.

Integration limits

The Docker run used Node 24 and a Linux ARM64 daemon; Linux/amd64 coverage remains for the existing browser-container CI job. The fixtures cover HTTP. Existing HTTP/CONNECT private-destination rejection tests remain, but these suites do not cover successful HTTPS navigation.

[jerelvelarde]

Reviewed head 6d16f0fa3a2f.

I would prioritize this because controlled fixtures make the browser and container checks useful merge gates for the rest of the queue. The changed factories retain their production defaults and destination validation; the fixture entrypoint stays outside the production image, with a read-only test mount and disposable container/profile cleanup. Exact PDF bytes and localStorage recovery without reseeding are stronger checks than third-party page assertions.

No blocking security or template-fit issue found in the current diff. The documented lack of successful HTTPS fixture navigation is an acceptance limit to keep visible, rather than something the HTTP tests prove. The workflow currently needs contributor approval (action_required); get that CI run green before landing. I reviewed code and author-reported results, but did not rerun Chromium or Docker. This should precede the final browser integration validation for #131.