Feature request: decouple the host running Artemis from the machine the phone is plugged into (remote USB / browser-side device bridge)

### Context

I'd like to run Artemis on a server while the phone stays connected by USB to a **different** machine — the laptop I actually sit in front of, which reaches the Artemis console over HTTPS from a network where I can install nothing and open no inbound port.

Today that split is not possible without building network plumbing. From reading the code, the only networked device mode is the remote ADB server endpoint:

- `AdbEndpoint` (`artemis/runtime/adb_endpoint.py`) with `mode = local | remote`, exposed as `ADB_HOST` / `ADB_PORT` and applied to child processes as `ADB_SERVER_SOCKET`.
- Console routes to probe / persist a remote endpoint, restricted to loopback unless `ARTEMIS_ALLOW_REMOTE_ADB_CONFIGURATION=true`.
- The `artemis-client` README documents the "device host" pattern and recommends an SSH tunnel, noting the admin API has no authentication.

So separating the agent host from the device host currently requires an **inbound, reachable** adb endpoint: same LAN, VPN, `ssh -R`, or an ingress TCP route. When the machine holding the phone cannot accept installs or inbound connections, there is no supported path at all — and exposing port 5037 publicly is not an option, since the adb protocol is neither authenticated nor encrypted.

### What I'd like to see

Either of these shapes would decouple the host running Artemis from the machine the phone is plugged into:

**A. Browser-side bridge (zero install on the device machine).** The console page claims the phone's ADB interface with **WebUSB** and forwards the adb traffic to the backend over the already-authenticated HTTPS/WebSocket session. The device host then needs no inbound path and no software, and the phone's USB traffic never leaves an authenticated channel. Prior art shows this is feasible: Tango / `ya-webadb` implements adb — including screen mirroring — over WebUSB in Chromium. Caveats: Chromium desktop only, secure context, per-device user gesture, and WAN latency on screenshot-heavy loops.

**B. Outbound-only device satellite.** A small `artemis-client`-side mode (or a dedicated daemon) that runs on the machine holding the USB device: it drives a local adb server and dials out to the Artemis host over an authenticated WebSocket, publishing the device. Because it is outbound-only it works behind NAT — no VPN, no SSH tunnel, no public port, and no unauthenticated adb socket on any network.

### Question

Is either shape in scope? If yes, which one would you prefer — the zero-install browser bridge, or the outbound satellite? I'm happy to prototype whichever you point at, but I'd rather ask first than build the wrong half.

*(I searched issues, PRs and discussions for `webusb`, `remote usb`, `wireless`, `wsl` and found nothing on this, so I'm opening a new thread rather than adding to an existing one.)*

Start with artemis/runtime/adb_endpoint.py, the console routes for remote endpoint configuration, and the artemis-client README's device-host guidance. The issue presents two architectural options but does not select one or define acceptance criteria, so the first step is to clarify scope before implementation.

Written by the indexing model from the issue text.