feat: add remote trust and server identity pinning

- Add SSH-style server identity keys and known-host verification for remote serve endpoints.
- Add remote add/list/remove commands for explicit endpoint persistence.
- Fix remote clients listing to fan out through target discovery instead of ambiguous auto-routing.
- Add URL glob matching for tabs filter and count with extension tests.
- Add n8n credential pinning for server public keys or SHA256 fingerprints.
- Remove obsolete compat shim behavior while keeping empty compat seams for future protocol changes.
- Bump browser-cli to 0.16.4 and n8n node to 0.3.1.
- Cover known-hosts, remote registry, compat seams, n8n protocol verification, and URL matching with tests.

n8n-nodes-browser-cli/nodes/BrowserCli/BrowserCli.node.ts

@@ -355,8 +355,8 @@ export class BrowserCli implements INodeType {
         name: 'pattern',
         type: 'string',
         default: '',
-        placeholder: '*.github.com/*',
-        description: 'URL glob pattern. Required for Filter; optional for Count (omit to count all).',
+        placeholder: 'twitch.tv/* or twitch.tv',
+        description: 'Matched against the full tab URL. A plain string is a case-sensitive substring match ("twitch.tv"); a pattern with "*" or "?" is a glob ("twitch.tv/*", "*.twitch.tv"). Glob needs the serve-side extension at 0.16.4+; older extensions treat the whole pattern as a literal substring. Required for Filter; optional for Count (omit to count all).',
         displayOptions: { show: showFor('tab', ['filter', 'count']) },
       },
       {
@@ -727,6 +727,8 @@ function connectOptionsFromCredentials(creds: IDataObject): ServeConnectOptions
     rejectUnauthorized: !creds.allowUnauthorizedCerts,
     privateKeyPem: creds.privateKey ? String(creds.privateKey) : null,
     route: creds.browser ? String(creds.browser) : null,
+    serverIdentity: creds.serverIdentity ? String(creds.serverIdentity) : null,
+    allowUnknownServerIdentity: Boolean(creds.allowUnknownServerIdentity),
   };
 }