mcp-rs: browser_session_state — context-level storage save/load (native port of #139)

Carrying forward the design from #139 (thanks @sujithps) as a native feature. The
Python server is deprecated, so this lands in mcp-rs — preferably as two
reviewable PRs:

1. Core/facade prerequisite: a real BrowserContext-level storage/cookie
   primitive (context creation/ownership, full storage-state capture across all
   tracked origins, validated replacement). Context-wide methods belong on a
   context handle, not Page.
2. MCP tool: browser_session_state with
   {"action": "save" | "load", "path": "<state-file>"} on that primitive —
   Playwright-compatible JSON (cookies + origins/localStorage), responses
   return path + counts, never values.

Key contract points (full rationale in the #139 review discussion):

• Load is replacement, not merge — keys/cookies absent from the file must not
  survive; apply once, no forever-replaying init script; empty arrays clear state.
• Save captures every tracked origin, not just the currently visible page's.
• Remote CDP mode: operate only on an MCP-owned isolated context; reject load
  rather than mutate a shared adopted context.
• Validate the whole document before any mutation; a failed load leaves state
  untouched.
• File policy: persistent confined state root (not the shutdown-cleaned
  screenshot temp dir), descriptor-anchored no-symlink traversal, bounded reads,
  atomic private-permission writes; treat the file as unredacted bearer
  credentials (never echo/log values).
• Out of scope initially (document, don't imply): sessionStorage, IndexedDB,
  service workers.
• No localStorage-only interim version — it would miss HttpOnly auth cookies,
  the core use case.

Test matrix should cover: cross-process round trip with an HttpOnly cookie,
origin-A save after navigating to B, A→B replacement semantics, scheme/host/port
isolation, invalid/oversized documents failing pre-mutation, shared-context
rejection, and path-confinement attacks (traversal, symlinks, non-regular files).

Start by reading the design carried forward from issue #139 and tracing BrowserContext ownership in mcp-rs. Split the work into the context-level storage primitive and the browser_session_state MCP tool, then run the stated test matrix. Done means validated Playwright-compatible save/load, replacement semantics, isolation and path-safety behavior without exposing stored values.