feat(browser-fetch): add lightpanda-backed fetch service and knowledge URL fallback

Adds a new browser-fetch microservice that wraps Lightpanda for rendering
JS-heavy pages, and wires it into the knowledge URL parser as a fallback
when the upstream link reader returns 403/429/5xx for an allow-listed
domain (e.g. zhuanlan.zhihu.com). Includes config/env plumbing, hot-reload
diff support, and full deploy assets (Dockerfile target, docker-compose,
k3s manifests, image-build/package scripts).

deploy/k3s/secrets.yaml

@@ -12,6 +12,7 @@ stringData:
   OPS_JWT_SECRET: geo-ops-change-me-in-production
   OPS_DEFAULT_ADMIN_PASSWORD: Aa123456
   SCHEDULER_INTERNAL_METRICS_TOKEN: geo-metrics-token
+  BROWSER_FETCH_TOKEN: geo-browser-fetch-change-me
   config.local.yaml: |
     database:
       password: ${POSTGRES_PASSWORD:geo_dev}
@@ -31,3 +32,6 @@ stringData:
 
     scheduler:
       internal_metrics_token: "geo-metrics-token"
+
+    browser_fetch:
+      token: ${BROWSER_FETCH_TOKEN:geo-browser-fetch-change-me}