feat(browser-fetch): add lightpanda-backed fetch service and knowledge URL fallback

Adds a new browser-fetch microservice that wraps Lightpanda for rendering
JS-heavy pages, and wires it into the knowledge URL parser as a fallback
when the upstream link reader returns 403/429/5xx for an allow-listed
domain (e.g. zhuanlan.zhihu.com). Includes config/env plumbing, hot-reload
diff support, and full deploy assets (Dockerfile target, docker-compose,
k3s manifests, image-build/package scripts).

server/Dockerfile

@@ -23,6 +23,12 @@ RUN --mount=type=cache,target=/go/pkg/mod \
     go build -trimpath -ldflags="-s -w" \
     -o /bin/service ./cmd/${SERVICE}
 
+RUN --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=cache,target=/root/.cache/go-build \
+    CGO_ENABLED=0 GOOS="${TARGETOS:-$(go env GOOS)}" GOARCH="${TARGETARCH:-$(go env GOARCH)}" \
+    go build -trimpath -ldflags="-s -w" \
+    -o /bin/browser-fetch ./cmd/browser-fetch
+
 RUN --mount=type=cache,target=/go/pkg/mod \
     --mount=type=cache,target=/root/.cache/go-build \
     CGO_ENABLED=1 GOOS="${TARGETOS:-$(go env GOOS)}" GOARCH="${TARGETARCH:-$(go env GOARCH)}" \
@@ -53,3 +59,13 @@ COPY configs/ /app/configs/
 
 EXPOSE 8080 8081
 ENTRYPOINT ["/app/service"]
+
+# ─── Stage 4: Browser fetch runtime (bundles Lightpanda) ──────────────────────
+FROM lightpanda/browser:nightly AS browser-fetch
+
+WORKDIR /app
+
+COPY --from=builder /bin/browser-fetch /app/service
+
+EXPOSE 8082
+ENTRYPOINT ["/app/service"]