Make the default Parsar Core connection zero-input

[sam2tom]

Summary

• make Local Parsar Core the zero-input default at /v1
• move direct URL and current-tab token controls into Advanced mode
• permit browser bearer tokens only for HTTPS direct targets or explicit loopback HTTP; reject credentials, query/fragment delimiters, and unsafe targets without rerouting them to the local Core
• add a single GET-only connection probe with a 5-second deadline, caller-abort fencing, canonical list/resource checks, precise 401/protocol/HTTP classification, and Unknown execution readiness
• invalidate stale probe results and cover keyboard, live-region, race, timeout, storage migration, and 390px behavior

Validation

• merged and validated against main@98c5b3312ad33e1fae8b94283a011eb3e5f4ee2c
• pnpm check (root 4/4, client 47/47, Web 291/291, typecheck and build passed)
• focused connection suites: 111/111 passed
• isolated Playwright apps/web/e2e/core-connection.spec.ts: 8/8 passed
• full Playwright suite: 36/36 passed
• git diff --check
• independent read-only final review found no P0/P1/P2 findings
• relative to latest main, the diff is exactly the eight Issue [agent] Make the default Parsar Core connection zero-input and testable #11 paths
• private Agent state remains untracked and absent from the commit

Boundaries

• no paid model call
• no deployment or Core mutation
• the probe never retries and never sends a browser token to /v1 or an unsafe direct target
• authenticated basic API access does not claim full protocol compatibility or executor, model, provider, or tool readiness

Closes #11