feat: add n8n serve node and harden remote access

- Add the n8n community node package with credentials, command mapping, direct serve TCP client, and browser-cli protocol crypto helpers.

- Cover Ed25519 signing, canonical JSON, PQ transport encryption, request mapping, and security behavior with unit tests.

- Harden serve-http with per-address rate limiting, an 8 MB request body cap, and clear warnings when binding plain HTTP beyond loopback.

- Stop one-shot --key overrides from being persisted automatically; document explicit remote trust and keep key-management behind the keys policy tier.

- Make HTML-to-Markdown conversion safer by bounding tree depth and dropping unsafe link/image URL schemes.

- Bump package and extension release metadata to 0.16.3.

tests/test_client.py

@@ -461,8 +461,8 @@ def test_domain_display_name_backward_compat_with_stored_443(monkeypatch, tmp_pa
   assert len(targets) == 1
   assert targets[0].display_name == "browsercli.yiprawr.dev:automatisation"
 
-def test_send_command_auto_saves_and_reuses_key_for_remote(monkeypatch, tmp_path):
-  """--key agent is saved on first use; omitting --key on subsequent calls reuses it."""
+def test_send_command_explicit_key_does_not_persist_remote_key(monkeypatch, tmp_path):
+  """--key is a one-shot override; use `browser-cli remote trust` to remember it."""
   import json as _json
 
   remotes_path = tmp_path / "remotes.json"
@@ -491,16 +491,12 @@ def test_send_command_auto_saves_and_reuses_key_for_remote(monkeypatch, tmp_path
 
   monkeypatch.setattr("browser_cli.client.core._send_remote", fake_send_remote)
 
-  # First call with explicit --key agent
   send_command("tabs.list", remote="host:8765", key=_Path("agent"))
   assert used_keys[-1] == "agent"
+  assert key_for_remote("host:8765") is None
 
-  # Key must be persisted now
-  assert key_for_remote("host:8765") == "agent"
-
-  # Second call without --key — should reuse saved "agent"
   send_command("tabs.list", remote="host:8765")
-  assert used_keys[-1] == "agent"
+  assert used_keys[-1] is None
 
 # ── async command transport ──────────────────────────────────────────────────