Add bounded image-only view frames for RC relay

[AetherAI3]

Summary

Add an observer-authorized, image-only POST /browser/view-frame endpoint and matching Python/Node client methods. The endpoint captures one bounded PNG from the owned session without extracting page text, accessibility, URL, or form values, and without consuming the model snapshot budget. It is limited to one frame per second per session and returns 429 with retry guidance on excess calls.

This is a local prerequisite for AETHER-PREDATOR-M #107's authenticated Aether RC browser relay. The unauthenticated noVNC port remains numeric-loopback-only and must not be tunneled. No Cloud relay or remote human input is claimed here.

Verification

• 90 server model/session/API/security tests passed.
• 2 focused runtime snapshot/view-frame tests passed.
• 26 Python client tests and 24 Node client tests passed.
• Ruff and Node TypeScript typecheck passed.
• Mypy passed with missing third-party patchright.async_api stubs and a pre-existing redundant cast suppressed; unmodified strict run reports only those two environment/baseline errors.
• The full Windows pytest run progressed through the relevant tests but stalls in existing cancellation tests in test_egress.py and test_runtime.py; this PR does not claim a full-suite pass.

Security boundary

Frames can visibly contain credentials typed by the human. A future RC relay must enforce owner/session grants and keep frame bytes out of model context, action logs, and issue artifacts. This PR does not put the local API or noVNC on a public listener.