[Feat] Settings: in-app folder browser (Browse button) to add a profile directory

## Overview
Add a "Browse…" button in **Settings → Agent Profile Directories** that opens a small in-app folder browser, so users can pick a directory instead of typing its full path. The browser lists folders the **backend** can see, so it works the same whether the backend runs locally, in WSL, in Docker, or on a remote host.

## User Stories
- As a user adding a profile directory, I want to click "Browse…" and pick a folder, so that I don't have to know or type the exact absolute path.
- As a user whose backend runs elsewhere (e.g. WSL or Docker), I want the picker to show the *server's* folders, so that the path I choose is actually valid for scanning.

## Acceptance Criteria
- A "Browse…" button next to the directory input.
- Clicking it opens a modal listing the subfolders of a starting directory (e.g. the backend user's home).
- The user can navigate into a folder and back up (breadcrumb or ".." entry).
- A "Select this folder" action fills the path and adds it to the list.
- The chosen path is valid on the backend's filesystem.

## Proposed solution
- **backend:** a read-only directory-listing endpoint, e.g. `GET /fs/list?path=...` returning `{ path, parent, folders: [...] }` (with path validation/limits for safety).
- **web:** a folder-browser modal wired to that endpoint, plus a "Browse…" button in `SettingsPanel.tsx` that opens it and writes the chosen path into the existing input.

## Additional context
**Is your feature request related to a problem? Please describe.**
Today a directory is added by typing its full absolute path, which is error-prone and assumes the user knows the exact path. It's especially confusing when the backend runs on a different machine/filesystem than the browser (WSL/Docker/remote): a native OS file-picker can't help, because browsers don't expose real paths to the page and the path must be valid on the *server*, not the client.

**Describe alternatives you've considered**
A native browser folder-picker (`` / `showDirectoryPicker()`) — not suitable, because browsers return a handle rather than a usable server path, and it would show the *client* machine's folders instead of the backend's.

**Additional context**
Noticed while running CAO with the backend in WSL and the browser on Windows.

Start with SettingsPanel.tsx and trace the existing Agent Profile Directories input and add flow. Then locate the backend entry point for a read-only GET /fs/list endpoint and review how filesystem paths are validated. Done means the Browse button opens a navigable modal, selecting a folder fills the existing input, and the selected path is valid on the backend.

Written by the indexing model from the issue text.