Add standalone browser AX control bridge

[BBKrogh]

Summary

• give AX-enabled standalone HTML surfaces short-lived, node-scoped grants
• restrict opaque-origin CORS access to requests with Origin: null
• revalidate every interaction against the node's effective AX capabilities
• poll live AX state while the standalone surface remains open
• expire grants after 12 hours and revoke them whenever the daemon restarts

Security model

Standalone grants are held only in server memory, bind to one HTML node, and are rejected if that node is removed or its AX capabilities are disabled. The browser bridge cannot broaden the node's configured capability ceiling, and all interactions continue through the normal applyAxInteraction validation boundary.

Validation

• targeted standalone AX server test
• TypeScript source and test type-check
• Biome check for the changed server implementation

[BBKrogh]

Closing at the author's request. We do not want to propose changes to this repository. The local office will remain a personal visual overview, with agents invoked manually from GitHub Copilot.