refactor: modularize auth transport and markdown

- Split auth into focused package modules for agent keys, file keys,
  signing, and post-quantum transport helpers while keeping the public
  browser_cli.auth import surface intact.
- Move transport encoding internals into a package with separate codec and
  binary-hoisting helpers, preserving browser_cli.transport compatibility.
- Extract remote TCP auth/socket helpers and serve challenge setup out of the
  runtime paths to make connection handling easier to reason about.
- Move the extension markdown extractor into a dedicated content/markdown
  folder with separate root selection, code normalization, renderer, and utils.
- Centralize CLI Rich rendering helpers for tab/window tree and table output,
  and add rendering tests for the shared builders.
- Remove local typing ignores in SDK/decorator/script plumbing and bump the
  package and extension version to 0.15.3.

browser_cli/serve/runtime.py

@@ -8,7 +8,6 @@ from __future__ import annotations
 
 import asyncio
 import json
-import secrets
 import socket
 from dataclasses import dataclass
 from pathlib import Path
@@ -17,10 +16,10 @@ from browser_cli import transport
 from browser_cli.compat import adapt_auth
 from browser_cli.framing import async_recv_frame, async_send_frame
 from browser_cli.serve.auth import ServeAuthMixin
+from browser_cli.serve.challenge import build_challenge as _build_challenge, load_auth_keys as _load_auth_keys
 from browser_cli.serve.control import ServeControlMixin
 from browser_cli.serve.logging import console, log_request
 from browser_cli.serve.proxy import ServeProxyMixin
-from browser_cli.version_manager import PROTOCOL_MIN_CLIENT, get_installed_version
 
 async def _async_framed_send(writer: asyncio.StreamWriter, data: bytes) -> None:
   await async_send_frame(writer, data)
@@ -140,29 +139,6 @@ async def _async_handle_client(
     except Exception:
       pass
 
-async def _load_auth_keys(auth_keys_path: Path | None) -> list[str] | None:
-  if auth_keys_path is None:
-    return None
-  from browser_cli.auth import load_authorized_keys
-  return await asyncio.to_thread(load_authorized_keys, auth_keys_path)
-
-async def _build_challenge(auth_keys_path: Path | None) -> tuple[str, object | None, dict]:
-  nonce = secrets.token_hex(32)
-  pq_private_key = None
-  challenge_msg = {
-    "type": "challenge",
-    "nonce": nonce,
-    "server_version": get_installed_version(),
-    "min_client_version": PROTOCOL_MIN_CLIENT,
-  }
-  if auth_keys_path is not None:
-    from browser_cli.auth import PQ_KEX_ALG, pq_kex_server_keypair
-    pq_keypair = await asyncio.to_thread(pq_kex_server_keypair)
-    if pq_keypair is not None:
-      pq_private_key, pq_public_key = pq_keypair
-      challenge_msg["pq_kex"] = {"alg": PQ_KEX_ALG, "public_key": pq_public_key.hex()}
-  return nonce, pq_private_key, challenge_msg
-
 def _handle_client(
   client_sock: socket.socket,
   addr: tuple,