Integrate browser sync with main

[lobbystack]

Brings the browser sync work (13 commits) together with main's later security hardening and the two startup-fix PRs. Resolved seven merge conflicts:

• CI workflows (ci.yml, server.yml): kept main's pinned action SHAs and persist-credentials: false, added the wasm-bindgen install steps and wasm32-unknown-unknown target the browser build needs, and pinned the new secret-scan job's actions.
• crates/local-core/src/path.rs: kept main's may_use_internal_paths reserved-directory hardening and cosmic's portable validate_managed_object_path call. Restored the enumerated loop the hardening needs.
• packages/plugin-sdk/src/index.ts: kept cosmic's platform/activation-capability runtime and re-applied main's freezeManifest snapshot, extended to freeze the new platforms and activationCapabilities fields.
• apps/server/OPERATIONS.md: kept main's Railway privilege-drop content, reflowed per the new prose rule.
• docs/provenance/better-auth-int8-patch.md (add/add): took the formatted version; content identical.
• bun.lock: regenerated from the merged manifests.

Verified on the branch: bun run check clean, 665 Bun tests pass, 362 Rust tests pass, cargo fmt and clippy clean, and bun run build succeeds. Merging to main will deploy the server.