feat: add remote trust and server identity pinning

- Add SSH-style server identity keys and known-host verification for remote serve endpoints.
- Add remote add/list/remove commands for explicit endpoint persistence.
- Fix remote clients listing to fan out through target discovery instead of ambiguous auto-routing.
- Add URL glob matching for tabs filter and count with extension tests.
- Add n8n credential pinning for server public keys or SHA256 fingerprints.
- Remove obsolete compat shim behavior while keeping empty compat seams for future protocol changes.
- Bump browser-cli to 0.16.4 and n8n node to 0.3.1.
- Cover known-hosts, remote registry, compat seams, n8n protocol verification, and URL matching with tests.

tests/test_client.py

@@ -649,6 +649,55 @@ def test_collect_browser_clients_uses_cached_target_version(monkeypatch, tmp_pat
     "extensionVersion": "0.15.6",
   }]
 
+def test_collect_browser_clients_with_explicit_remote_lists_all_targets(monkeypatch, tmp_path):
+  """`browser-cli --remote host clients` should list all profiles, not auto-route and fail as ambiguous."""
+  from browser_cli.client import collect_browser_clients
+  import browser_cli.client.core as core
+
+  targets = [
+    BrowserTarget(
+      profile="main",
+      display_name="browser-host.example:main",
+      socket_path="",
+      remote="browser-host.example:8765",
+      browser_name="Chrome",
+      display_group="browser-host.example",
+      version="149.0.0.0",
+      extension_version="0.16.4",
+    ),
+    BrowserTarget(
+      profile="work",
+      display_name="browser-host.example:work",
+      socket_path="",
+      remote="browser-host.example:8765",
+      browser_name="Firefox",
+      display_group="browser-host.example",
+      version="151.0",
+      extension_version="0.16.4",
+    ),
+  ]
+  monkeypatch.setattr(core, "remote_browser_targets", lambda endpoint, key=None: targets)
+  monkeypatch.setattr(core, "send_command", lambda *a, **k: pytest.fail("clients.list must not auto-route for cached targets"))
+
+  rows = collect_browser_clients(remote="browser-host.example:8765", registry_path=tmp_path / "missing-registry.json")
+
+  assert [row["profile"] for row in rows] == ["browser-host.example:main", "browser-host.example:work"]
+  assert [row["name"] for row in rows] == ["Chrome", "Firefox"]
+
+def test_collect_browser_clients_with_explicit_remote_and_browser_filters_target(monkeypatch, tmp_path):
+  from browser_cli.client import collect_browser_clients
+  import browser_cli.client.core as core
+
+  targets = [
+    BrowserTarget("main", "browser-host.example:main", "", remote="browser-host.example:8765", version="1"),
+    BrowserTarget("work", "browser-host.example:work", "", remote="browser-host.example:8765", version="1"),
+  ]
+  monkeypatch.setattr(core, "remote_browser_targets", lambda endpoint, key=None: targets)
+
+  rows = collect_browser_clients(remote="browser-host.example:8765", browser_alias="work", registry_path=tmp_path / "missing-registry.json")
+
+  assert [row["profile"] for row in rows] == ["browser-host.example:work"]
+
 def test_collect_browser_clients_falls_back_when_version_unknown(monkeypatch, tmp_path):
   """An older remote (no advertised version) still triggers a clients.list query."""
   from browser_cli.client import collect_browser_clients