fix: attach browser-level CDP endpoints to a page target

[huluma1314]

Summary

• auto-discover local Chrome CDP endpoints from DevToolsActivePort when OPENCLI_CDP_ENDPOINT is unset or set to auto
• treat browser-level websocket endpoints as attachable roots and bind them to a real page target before sending Page/Runtime commands
• make doctor report CDP mode explicitly and cover browser-level target selection with unit tests

Why

On macOS Chrome exposing DevToolsActivePort, OpenCLI can discover a browser-level websocket like ws://127.0.0.1:9222/devtools/browser/<id> even when the standard /json target listing is unavailable. Before this change, CDP mode assumed it already had a page-level target, so browser commands and opencli doctor could fail before any page interaction.

Validation

• npm test -- src/browser/cdp.test.ts src/browser.test.ts
• npm run build

[Astro-Han]

Hi! PR #408 covers similar ground: browser-level WebSocket discovery, page target attach, and DevToolsActivePort fallback. It's been through a few rounds of review and might merge soon. Might be worth checking if there's a gap this PR addresses that #408 doesn't.