feat(nests): T16 Phase 4.A+B — browser-side cross-stack interop scaffold + I1 forward

Lands the bun + Playwright + headless Chromium harness for the
T16 cross-stack interop suite, parallel to the existing Rust
hang-listen tier. New top-level `nestsClient-browser-interop/`
directory with `@moq/lite` + `@moq/hang` 0.2.x pinned, a bun
static + WebSocket back-channel server, and a Playwright runner
that opens `listen.html` against the same `NativeMoqRelayHarness`
moq-relay subprocess the Rust scenarios use.

Kotlin side: `PlaywrightDriver` shells out to `bun x playwright
test`, forwards the relay URL + leaf-cert SHA-256 (captured via
a custom `CertCapturingValidator` during the speaker's QUIC
handshake), and reads back Float32 LE PCM frames from a tempfile
the bun WS server appends to. `BrowserInteropTest` ships I1
forward — Amethyst Kotlin speaker → Chromium `@moq/lite`
listener, asserting FFT 440 Hz on the captured tail.

Why pin via `serverCertificateHashes` instead of
`--ignore-certificate-errors`: Chromium's flag does NOT bypass
QUIC cert validation (crbug.com/1190655). `serverCertificateHashes`
is the supported path; moq-relay's `--tls-generate` produces a
14-day ECDSA P-256 cert that satisfies the spec.

Two Gradle tasks added: `interopBuildBrowserHarness` (bun
install + bun build → dist/) and `interopInstallPlaywrightChromium`
(skipped when `PLAYWRIGHT_BROWSERS_PATH` already has a chromium
build, as on the agent runner).

Verification:
- `./gradlew :nestsClient:jvmTest --tests
   com.vitorpamplona.nestsclient.interop.native.BrowserInteropTest
   -DnestsHangInterop=true -DnestsBrowserInterop=true` green.
- I1 forward asserts ≥ 1 s of decoded PCM with 440 Hz FFT peak.
  Looser sample-count bound than the hang-tier I1 because
  Chromium cold-launch + WebTransport handshake (3–5 s) + the
  publisher's `framesPerGroup = 5` per-subscriber cache cliff
  means the page captures only the broadcast tail.

Phase 4.C (I2/I3/I4/I13/I14/I15) and 4.D (CI) are separate
follow-up commits per the plan's per-scenario commit guidance.

See: nestsClient/plans/2026-05-06-phase4-browser-harness.md

https://claude.ai/code/session_01ERJPUYfdLPwZ99pr5EcEcV

nestsClient-browser-interop/REV

@@ -0,0 +1,31 @@
+# Pinned upstream npm package versions for the browser-side cross-stack
+# interop harness (Phase 4 of T16).
+#
+# These versions are what `nestsClient-browser-interop/package.json` pins
+# and what the bun build resolves at install time. Bumping requires
+# touching package.json + bun.lockb + this file together so a silent
+# upstream rev change can't mask a regression.
+#
+# See: nestsClient/plans/2026-05-06-phase4-browser-harness.md
+#
+# Source: https://github.com/kixelated/moq , workspace published to npm
+# under the @moq/* scope. The `@moq/lite` 0.2.x line implements
+# `moq-lite-03` (see /tmp/moq/js/lite/src/lite/), matching the pin in
+# nestsClient/tests/hang-interop/REV (KIXELATED_MOQ_GIT_REV).
+
+# Browser listener: builds Watch.Broadcast on top of @moq/lite +
+# @moq/hang. We use @moq/lite + @moq/hang directly for the harness path
+# (closer to nestsClient's own moq-lite stack) but keep @moq/watch
+# pinned in case a future scenario wants the higher-level reactive
+# Broadcast wrapper.
+MOQ_WATCH_VERSION=0.2.10
+
+# Browser publisher: same story for @moq/publish.
+MOQ_PUBLISH_VERSION=0.2.6
+
+# Lower-level moq-lite-03 client + hang catalog/container.
+MOQ_LITE_VERSION=0.2.2
+MOQ_HANG_VERSION=0.2.4
+
+# Playwright Chromium driver.
+PLAYWRIGHT_VERSION=1.56.1