v1.39.0.0 feat: buildFetchHandler factory unblocks gbrowser submodule consumption (#1511)

* feat: buildFetchHandler factory unblocks gbrowser submodule consumption

Add buildFetchHandler(cfg: ServerConfig): ServerHandle in browse/src/server.ts.
Refactor start() to delegate handler construction to the factory and read env
once via resolveConfigFromEnv(). Wire the beforeRoute hook (runs after the
tunnel surface filter, before per-route dispatch).

Auth is now cfg-driven end-to-end. Module-level AUTH_TOKEN const +
initRegistry(AUTH_TOKEN) boot call, validateAuth, and shutdown are deleted;
factory closure owns them. start() threads cfg.authToken into launchHeaded,
the state-file write, and the factory.

initRegistry is idempotent for same-token re-init; throws clearly for
different-token re-init. __resetRegistry() test helper added (mirrors
__resetConnectRateLimit). Existing tests that did rotateRoot() ->
initRegistry('fixed-token') swap to __resetRegistry() to avoid the new guard.

14 factory contract tests added covering ServerHandle shape, auth wiring,
validation throws, hook semantics across both surfaces, and registry
idempotency.

Source-pattern tests in dual-listener.test.ts and server-auth.test.ts
updated for the new identifiers (handle.fetchLocal/fetchTunnel, authToken,
shutdownFn).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* chore: bump version and changelog (v1.39.0.0)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

browse/test/skill-token.test.ts

@@ -11,7 +11,7 @@
 
 import { describe, it, expect, beforeEach } from 'bun:test';
 import {
-  initRegistry, rotateRoot, validateToken, checkScope,
+  initRegistry, __resetRegistry, validateToken, checkScope,
 } from '../src/token-registry';
 import {
   generateSpawnId,
@@ -22,7 +22,9 @@ import {
 
 describe('skill-token', () => {
   beforeEach(() => {
-    rotateRoot();
+    // __resetRegistry zeroes rootToken so the new initRegistry mismatch guard
+    // doesn't fire on the immediate initRegistry call.
+    __resetRegistry();
     initRegistry('root-token-for-tests');
   });