feat: add remote trust and server identity pinning

- Add SSH-style server identity keys and known-host verification for remote serve endpoints.
- Add remote add/list/remove commands for explicit endpoint persistence.
- Fix remote clients listing to fan out through target discovery instead of ambiguous auto-routing.
- Add URL glob matching for tabs filter and count with extension tests.
- Add n8n credential pinning for server public keys or SHA256 fingerprints.
- Remove obsolete compat shim behavior while keeping empty compat seams for future protocol changes.
- Bump browser-cli to 0.16.4 and n8n node to 0.3.1.
- Cover known-hosts, remote registry, compat seams, n8n protocol verification, and URL matching with tests.

n8n-nodes-browser-cli/nodes/BrowserCli/serveClient.ts

@@ -10,7 +10,7 @@ import { connect as tlsConnect } from 'node:tls';
 import type { Socket } from 'node:net';
 import { randomUUID } from 'node:crypto';
 
-import { buildAuthPayload, decodeResponse, frame, type Challenge } from './protocol';
+import { buildAuthPayload, decodeResponse, frame, verifyServerIdentity, type Challenge } from './protocol';
 
 /** Version advertised to the server. Must be >= the server's PROTOCOL_MIN_CLIENT
  * (0.9.0) and >= 0.9.5 so the server enforces the post-quantum handshake this
@@ -33,6 +33,10 @@ export interface ServeConnectOptions {
   privateKeyPem?: string | null;
   /** Optional `_route` target for a multi-browser serve. */
   route?: string | null;
+  /** Expected server identity: raw Ed25519 public key hex or SHA256 fingerprint. */
+  serverIdentity?: string | null;
+  /** Allow unknown server identities (TOFU disabled). Intended for loopback/dev only. */
+  allowUnknownServerIdentity?: boolean;
   timeoutMs?: number;
 }
 
@@ -121,6 +125,12 @@ export async function sendServeCommand(
     const run = async () => {
       const challengeRaw = await reader.next();
       const challenge = JSON.parse(challengeRaw.toString('utf8')) as Challenge;
+      verifyServerIdentity(
+        challenge,
+        opts.serverIdentity,
+        `${opts.host}:${opts.port}`,
+        Boolean(opts.allowUnknownServerIdentity),
+      );
 
       const baseMsg: Record<string, unknown> = {
         id: randomUUID(),