feat(browser-fetch): add lightpanda-backed fetch service and knowledge URL fallback

Adds a new browser-fetch microservice that wraps Lightpanda for rendering
JS-heavy pages, and wires it into the knowledge URL parser as a fallback
when the upstream link reader returns 403/429/5xx for an allow-listed
domain (e.g. zhuanlan.zhihu.com). Includes config/env plumbing, hot-reload
diff support, and full deploy assets (Dockerfile target, docker-compose,
k3s manifests, image-build/package scripts).

deploy/scripts/gitea-registry-images.sh

@@ -16,7 +16,7 @@ REGISTRY_PASSWORD="${REGISTRY_PASSWORD:-}"
 REGISTRY_PLAIN_HTTP="${REGISTRY_PLAIN_HTTP:-true}"
 REGISTRY_SCHEME="${REGISTRY_SCHEME:-}"
 IMAGE_TAG="${IMAGE_TAG:-}"
-IMAGE_LIST="${IMAGE_LIST:-tenant-api ops-api worker-generate kol-assist-worker scheduler frontend ops-web migrate}"
+IMAGE_LIST="${IMAGE_LIST:-tenant-api browser-fetch ops-api worker-generate kol-assist-worker scheduler frontend ops-web migrate}"
 DELETE_OLD_IMAGE_TAGS="${DELETE_OLD_IMAGE_TAGS:-true}"
 PUSH_LATEST="${PUSH_LATEST:-true}"
 FORCE_BUILD="${FORCE_BUILD:-false}"
@@ -257,6 +257,15 @@ build_image() {
         -f "${REPO_ROOT}/server/Dockerfile" \
         "${REPO_ROOT}/server"
       ;;
+    browser-fetch)
+      docker build "${platform_args[@]}" \
+        --target browser-fetch \
+        --build-arg "SERVICE=browser-fetch" \
+        --tag "${repo}:${IMAGE_TAG}" \
+        --tag "${repo}:latest" \
+        -f "${REPO_ROOT}/server/Dockerfile" \
+        "${REPO_ROOT}/server"
+      ;;
     tenant-api|worker-generate|kol-assist-worker|scheduler|ops-api)
       docker build "${platform_args[@]}" \
         --target runtime \