feature: let background tasks operate web pages

[asasemahmed]

Builds on #62, so this PR includes its commit until #62 is merged.

What changed

Background tasks can now operate the page read_web opened: page_elements, page_act and save_page_downloads.

• Password, payment and one-time-code fields are never typed into.
• A step that buys, sends, submits, deletes, books or signs up pauses the task and asks the person, naming the real button.
• A confirmation is only accepted for the exact step, on the same page, that the task asked about.

Verification

• New test: a task fills a form, pauses before "Place order", ignores a confirmation for a step it never asked about, and places the order after the person says yes.
• Tried with a real model: the task filled the httpbin order form, asked once, and submitted after "yes".
• pnpm typecheck passes.

[davidmckayv]

Closing. This includes all of #62 and runs it unattended, so it inherits every problem listed there, and it adds more.

It deletes the task-prompt instruction "interactive reservations currently require user browser takeover" without replacing it. When a risky step is refused, the task asks a free-text question and never checks the answer: replying "NO. Do not place the order. Stop." still lets the confirmed click through. A confirmed click that times out or crashes stays armed and can be replayed, which breaks the CONTRIBUTING rule "do not retry a possibly completed write."

Page writes by background tasks need the same persisted action review sends use, and agreed scope in an issue, before a change like this is proposed.