feat(browser-fetch): add lightpanda-backed fetch service and knowledge URL fallback

Adds a new browser-fetch microservice that wraps Lightpanda for rendering
JS-heavy pages, and wires it into the knowledge URL parser as a fallback
when the upstream link reader returns 403/429/5xx for an allow-listed
domain (e.g. zhuanlan.zhihu.com). Includes config/env plumbing, hot-reload
diff support, and full deploy assets (Dockerfile target, docker-compose,
k3s manifests, image-build/package scripts).

deploy/scripts/package.sh

@@ -59,7 +59,7 @@ cd "${REPO_ROOT}"
 
 if [[ -n "${SOURCE_IMAGE_REGISTRY}" ]]; then
   echo "    pulling from ${SOURCE_IMAGE_REGISTRY}"
-  for svc in tenant-api worker-generate kol-assist-worker ops-api scheduler migrate frontend ops-web; do
+  for svc in tenant-api browser-fetch worker-generate kol-assist-worker ops-api scheduler migrate frontend ops-web; do
     echo "    pulling ${SOURCE_IMAGE_REGISTRY}/${svc}:${IMAGE_TAG}"
     docker pull --platform "${PLATFORM}" "${SOURCE_IMAGE_REGISTRY}/${svc}:${IMAGE_TAG}"
     docker tag "${SOURCE_IMAGE_REGISTRY}/${svc}:${IMAGE_TAG}" "${LOCAL_PREFIX}/${svc}:${IMAGE_TAG}"
@@ -81,6 +81,7 @@ else
   }
 
   _build runtime tenant-api      --build-arg SERVICE=tenant-api
+  _build browser-fetch browser-fetch --build-arg SERVICE=browser-fetch
   _build runtime worker-generate --build-arg SERVICE=worker-generate
   _build runtime kol-assist-worker --build-arg SERVICE=kol-assist-worker
   _build runtime ops-api         --build-arg SERVICE=ops-api
@@ -127,6 +128,7 @@ mkdir -p "${WORK_DIR}"
 
 ALL_IMAGES=(
   "${LOCAL_PREFIX}/tenant-api:${IMAGE_TAG}"
+  "${LOCAL_PREFIX}/browser-fetch:${IMAGE_TAG}"
   "${LOCAL_PREFIX}/worker-generate:${IMAGE_TAG}"
   "${LOCAL_PREFIX}/kol-assist-worker:${IMAGE_TAG}"
   "${LOCAL_PREFIX}/scheduler:${IMAGE_TAG}"