fix(arch): unify TS/Rust types + classroom persistence registration + approval audit

- M11-03: Register ClassroomPersistence via Tauri .setup() hook with
  in-memory fallback. Previously missing — classroom commands would crash at runtime.
- M3-02: Document BrowserHand as schema validator + TypeScript delegation
  passthrough (dual-path architecture explicitly documented).
- M4-04: Add defense-in-depth audit logging in execute_hand() and
  execute_hand_with_source() when needs_approval hands bypass approval gate.
- TYPE-01: Add #[serde(rename_all = "camelCase")] to Rust AgentInfo.
  Add missing fields to TS AgentInfo (messageCount, createdAt, updatedAt).
  Fix KernelStatus TS interface to match Rust KernelStatusResponse
  (baseUrl/model instead of defaultProvider/defaultModel).
- SEC2-P1-01: Document EXTRACTION_DRIVER OnceCell as legacy path;
  Kernel struct field is the active path.
- TriggerSource: Add #[derive(PartialEq)] for approval audit comparisons.

crates/zclaw-hands/src/hands/browser.rs

@@ -1,14 +1,19 @@
-//! Browser Hand - Web automation capabilities
+//! Browser Hand - Web automation capabilities (TypeScript delegation)
 //!
-//! Provides browser automation actions for web interaction:
-//! - navigate: Navigate to a URL
-//! - click: Click on an element
-//! - type: Type text into an input field
-//! - scrape: Extract content from the page
-//! - screenshot: Take a screenshot
-//! - fill_form: Fill out a form
-//! - wait: Wait for an element to appear
-//! - execute: Execute JavaScript
+//! **Architecture note (M3-02):** This Rust Hand is a **schema validator and passthrough**.
+//! Every action returns `{"status": "pending_execution"}` — no real browser work happens here.
+//!
+//! The actual execution path is:
+//! 1. Frontend `HandsPanel.tsx` intercepts browser hands → routes to `BrowserHandCard`
+//! 2. `BrowserHandCard` calls `browserHandStore.executeTemplate/executeScript`
+//! 3. TypeScript calls Tauri `browser_*` commands (Fantoccini-based, defined in `browser/commands.rs`)
+//!
+//! This dual-path exists because browser automation requires a WebDriver session managed
+//! on the TypeScript side (session lifecycle, error recovery, UI feedback). The Rust Hand
+//! serves as a typed schema for the action DSL and satisfies the HandRegistry contract.
+//!
+//! Supported actions: navigate, click, type, scrape, screenshot, fill_form, wait, execute,
+//! get_source, get_url, get_title, scroll, back, forward, refresh, hover, press_key, upload, select
 
 use async_trait::async_trait;
 use serde::{Deserialize, Serialize};