feat: align browser callback runtime and export flows

Consolidate the browser task runtime around the callback path, add safer artifact opening for Zhihu exports, and cover the new service/browser flows with focused tests and supporting docs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/security/mod.rs

@@ -14,6 +14,8 @@ pub enum SecurityError {
     ActionNotAllowed(String),
     #[error("domain is not allowed: {0}")]
     DomainNotAllowed(String),
+    #[error("invalid local dashboard request: {0}")]
+    InvalidLocalDashboard(String),
     #[error("invalid rules: {0}")]
     InvalidRules(String),
     #[error("hmac error: {0}")]