Make browser sidecar on-demand (#44) (#50)

Closes #44. Chrome now starts on first CDP connection, tracks concurrent helpers, reaps after 300 seconds idle, preserves the named profile, and classifies reap interruptions. Shutdown stops Chrome's process group so cookie batches flush. ADR-0005 records the measured constraints and decisions. Verification: docker build, live CDP wake, graceful stop cleanup, sh -n, and go test ./... (7 packages, 3 no tests).

Reviewed-on: #50
Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com>
Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>

chrome/Dockerfile

@@ -18,7 +18,7 @@ FROM debian:trixie-slim
 # stale, and a stale browser is exactly what Cloudflare turns away — the 124 in
 # alpine-chrome is the worked example. Rebuild is the upgrade path.
 RUN apt-get update \
- && apt-get install -y --no-install-recommends ca-certificates wget gnupg \
+ && apt-get install -y --no-install-recommends ca-certificates wget gnupg util-linux \
  && wget -qO- https://dl.google.com/linux/linux_signing_key.pub \
       | gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg \
  && echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] https://dl.google.com/linux/chrome/deb/ stable main" \
@@ -27,9 +27,15 @@ RUN apt-get update \
  && apt-get install -y --no-install-recommends google-chrome-stable socat \
  && rm -rf /var/lib/apt/lists/*
 
+# Keep the profile path present so Docker initializes the named volume with
+# the unprivileged user's ownership.
+
+RUN useradd --create-home --shell /usr/sbin/nologin chrome \
+ && mkdir -p /home/chrome/profile /home/chrome/state \
+ && chown -R chrome:chrome /home/chrome
+
 # Unprivileged: Chrome refuses to run as root, and the CDP endpoint is a shell
 # on whatever user owns it.
-RUN useradd --create-home --shell /usr/sbin/nologin chrome
 USER chrome
 WORKDIR /home/chrome