Browser preview for exposures through the confined router

## Problem

#207 moves container exposures onto authenticated HTTP but deliberately leaves browser preview out: opening a web app served inside a VM or container in the browser through Capsem.

The prototype on local branch `worktree/gateway-sdk-runtime-draft` (commits `421891f0c`, `7e6720c4a`, `433a44d05`, `90f72cfdf`) was reviewed and rejected:

- **The gateway carries workload bytes.** `preview::forward` is a hyper reverse proxy plus `copy_bidirectional` for WebSockets, running in the process that holds the admin token. Those bytes get no router quota, and the gateway parses untrusted guest HTTP responses.
- **Preview hosts skip the host guard.** `*.localhost` hosts are handed to preview before the gateway's loopback-host and token checks, so the cookie becomes the only credential.
- **The bootstrap token travels in the URL query**, where it leaks through `TraceLayer`, browser history and `Referer`.
- **Guest response headers pass through unfiltered**, including `Set-Cookie`.
- **Revocation is inferred by parsing request paths** in `proxy.rs`, which misses crash, reaper, pause and shutdown teardown.
- **Every asset costs a policy evaluation and a service round-trip** (`/admit`), duplicating the admission the VM owner already does per connection.

## Outcome

- A preview session is scoped to one exposure, carries its owner generation, and is revoked by the VM owner's teardown.
- The confined router is the only byte carrier; the gateway authenticates and hands off the accepted socket descriptor.
- Each exposure gets its own origin, a single-use bootstrap token that never appears in a URL query, HttpOnly scoped cookies, and filtered or namespaced guest cookies and credentials.
- The existing security engine authorizes once per session or connection on the owner.
- macOS VM acceptance covers assets, forms, redirects, streaming, WebSocket upgrades, cross-exposure denial, and zero destination bytes when policy denies.

## Depends on

#207 (exposure contract, authorization and teardown proven first).

Start by reading #207 and the rejected prototype commits 421891f0c, 7e6720c4a, 433a44d05, and 90f72cfdf, then inspect proxy.rs. The implementation should keep the confined router as the only byte carrier, scope and revoke sessions through VM teardown, avoid URL-query bootstrap tokens, isolate credentials, and authorize once per session or connection. Done means the macOS VM acceptance coverage includes assets, forms, redirects, streaming, WebSocket upgrades, cross-exposure denial, and zero destination bytes on policy denial.

Written by the indexing model from the issue text.