feat: surface HTTP auth / client-certificate challenges instead of hanging until timeout

Problem

When a site requires HTTP authentication (Basic / Digest / NTLM — common on corporate intranets) or a client TLS certificate, Chrome suspends the navigation behind a modal prompt. agent-browser has no handler for these challenges:

• Fetch.authRequired is only wired up when proxy credentials are configured (cli/src/native/actions.rs), and only answers with those proxy credentials;
• there is no client-certificate handling at all.

Result: open blocks until the 25s lifecycle timeout and returns a generic "Operation timed out. The page may still be loading..." error, with no indication that an auth challenge is waiting for input. In headed mode a human could complete the dialog, but nothing tells the agent/user that this is what's blocking; in headless mode there is no way through at all.

This bites in the same real-world scenario as #1765 (intranet SSO auto-login): the navigation stalls, the agent sees only a generic timeout, retries, and loops.

Proposal (incremental)

1. Detect and report (the valuable half): enable Fetch auth handling (or listen for the relevant target events) so a pending auth challenge is surfaced promptly in the command result — e.g. open returns quickly with a structured "authentication required: Basic realm X at URL" state instead of a 25s blind timeout. Client-certificate prompts can likewise be detected and reported ("client certificate requested").
2. Answer programmatically (optional follow-up): allow supplying credentials / certificate selection via config or the existing auth profile machinery, mapping to Fetch.continueWithAuth.

Step 1 alone turns a 25s mystery hang into actionable feedback, and in headed mode tells the user exactly which dialog to complete. Happy to discuss the approach and implement.