Add WebFetch access with short-lived device delegation

[Daily-AC]

What changes

Web chat AIs that can fetch URLs can now request temporary access to selected wanctl devices, wait for owner approval in the existing portal, and call one-shot commands or text-file operations through an opt-in /webfetch adapter. Authorization remains in wanctl: device scope and expiration are enforced by the relay, while pairing, rules and operation approval remain on the controlled device.

The owner chooses up to 16 owned devices and a 1–60 minute duration. Delegated credentials cannot enroll devices, administer them, mint credentials, or reuse another credential's session. Both carriers preserve scope, revalidate active leases, and check again after a delayed human approval. Persistent jobs deduplicate repeated GET requests; interrupted outcomes are not automatically rerun. Results are also unavailable after revocation.

The adapter uses a distinct controller identity per grant and never executes through the privileged portal identity. Browser tickets and relay credentials are stored only as hashes; raw relay credentials never enter AI-facing URLs. The trusted adapter sees its own plaintext, as documented. Inactive content is cleaned up after 24 hours without allowing old browser tickets to recreate grants.

Fixes #72.

Validation

• Full go test ./... with real PostgreSQL; tagged test/build/vet checks and focused race tests for delegation, all four carrier combinations, expiry/revocation, late approvals, audit attribution and client cancellation.
• Real Qwen3.8-Max browser run against an isolated wanctl deployment: pending request, owner approval, initial unpaired rejection, existing portal pairing, successful command and exact file write/read, then HTTP 403 for both old results and new commands after portal revocation. The device used normal policy, with only a test directory and one harmless command allowed. Acceptance details.
• Formatting, JavaScript syntax and changed-patch secret scan passed. A repository-wide secret scan reports seven existing findings in unchanged test/fixture/design files; none are introduced by this patch.
• CI now provisions PostgreSQL so the database and adapter integration tests do not silently skip.

Deployment and compatibility

Disabled by default. Requires PostgreSQL and explicit WebFetch seed/public-origin/portal-origin configuration; no existing production deployment was changed. Relay, portal and controlled agents must be upgraded together for this feature: older agents reject delegated sessions.

Before rollback to a pre-feature relay, revoke all delegated tokens; old namespace-only resolvers do not understand their constraints. Revocation closes connected one-shot sessions but cannot undo completed effects or guarantee cleanup of deliberately detached processes. See operator documentation and 中文说明.