Add llama.cpp backend, model gateway, URL relay and browser view

Four features, plus a latent bug fix.

llama.cpp backend. Claude Code only ever speaks the Anthropic Messages
API — confirmed empirically by pointing it at a logging server, which
received POST /v1/messages?beta=true. llama-server implements that
natively (verified in its README, alongside --port default 8080), so
this is a plain base-URL backend with no translation shim, the same
shape as Ollama. Its --api-key defaults to none, so the auth token is a
placeholder Claude Code requires and llama-server ignores.

Model alias fix. ANTHROPIC_DEFAULT_HAIKU_MODEL is documented as "also
used for background functionality", and Triple-C set none of the alias
vars. So on every custom-endpoint backend, Claude Code resolved `haiku`
to an Anthropic model id and sent it to a local server that does not
have it — background features failed silently. All four
ANTHROPIC_DEFAULT_{OPUS,SONNET,HAIKU,FABLE}_MODEL vars are now pinned to
the backend's configured model, with an optional Haiku override, and
blanked for Anthropic and Bedrock so those keep Claude Code's defaults.
The deprecated ANTHROPIC_SMALL_FAST_MODEL is never emitted. Existing
Ollama and OpenAI-Compatible containers are recreated once so the new
env reaches them; the snapshot is preserved.

Model gateway. Optional LiteLLM sibling container, off by default,
mirroring stt.rs — this is what makes real OpenAI usable, since
api.openai.com has no /v1/messages. Pinned to v1.96.0 by tag and digest:
the 1.82.7/1.82.8 malware was PyPI-only and never affected the official
images, which is precisely why this builds FROM the image rather than
pip-installing, but 1.84.0 is still the floor for proxy CVEs (API-key
SQLi, Host-header auth bypass, MCP auth bypass). Binds 0.0.0.0 because
project containers consume it, and therefore always sets a master_key —
LiteLLM without one accepts any key. The provider key lives in the OS
keychain and is uploaded into a volume, never an image layer or label.

URL relay. A container-side xdg-open/BROWSER shim opens URLs in the
host's browser. Uses an OSC sequence to /dev/tty rather than a printed
sentinel, because the shim usually runs as a grandchild of a process
capturing its children's output. Degrades to printing the URL when no
terminal is attached, so scheduled tasks do not hang. Only http/https,
with control characters rejected before new URL() — which strips
newlines, so java\nscript: would otherwise parse as javascript:. Nothing
auto-opens; the user confirms. The web terminal shows a tap-to-open
banner instead, since that browser may be a phone across a tunnel.

Browser view. A Project Home tab that watches and takes over the browser
Claude drives with Playwright, using Playwright's own dashboard. Zero
image cost — Playwright stays user-installed. It does not reuse the auth
bridge's PortForward, which binds an unauthenticated port: correct for a
throwaway OAuth listener, wrong for mouse and keyboard control of a
browser in a passwordless-sudo container. Instead a token-gated loopback
proxy checks Host, then token or a forbidden-header origin signal,
before a byte reaches the container. Host ports are confined to
47820..=47827 so CSP frame-src can enumerate them rather than widening
to a wildcard, with a test asserting the two agree.

188 frontend tests, 107 Rust tests, both builds clean.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

container/Dockerfile

@@ -162,6 +162,57 @@ RUN chmod +x /usr/local/bin/audio-shim \
     && ln -sf /usr/local/bin/audio-shim /usr/local/bin/rec \
     && ln -sf /usr/local/bin/audio-shim /usr/local/bin/arecord
 
+# ── URL relay shim (host browser) ───────────────────────────────────────────
+# Container-side stand-in for a browser. Emits an OSC 7777 escape sequence that
+# Triple-C's terminal front-end intercepts and turns into a host-browser open.
+# Installed under every name a CLI conventionally consults, plus $BROWSER.
+#
+# What Ubuntu 24.04's base actually ships (verified, not assumed):
+#   sensible-browser  PRESENT  (/usr/bin/sensible-browser, from sensible-utils)
+#   xdg-open          absent   (xdg-utils is not installed)
+#   www-browser       absent   (no update-alternatives entry)
+#   x-www-browser     absent   (no update-alternatives entry)
+#   gnome-open / gvfs-open / kde-open / open   absent
+#
+# So the three names that need real handling, not just a symlink:
+#   * sensible-browser is a dpkg-owned file. A /usr/local/bin symlink would
+#     only shadow it for PATH lookups, leaving absolute-path callers on the
+#     stock script — so it is dpkg-diverted and replaced. (The stock script
+#     does defer to $BROWSER, but only when $BROWSER is set; diverting makes
+#     the behaviour unconditional and survives package upgrades.)
+#   * www-browser / x-www-browser are update-alternatives names, so they are
+#     registered as alternatives rather than hand-symlinked. This matters:
+#     sensible-browser probes /usr/bin/x-www-browser by absolute path, which
+#     only exists if something registered the alternative. `--set` pins them
+#     to manual mode so a later `apt install firefox` cannot steal them and
+#     point the container at a browser it has no display to run.
+#   * xdg-open is diverted pre-emptively so that if someone later installs
+#     xdg-utils inside the container, dpkg unpacks to xdg-open.distrib and
+#     our relay keeps /usr/bin/xdg-open.
+COPY triple-c-open /usr/local/bin/triple-c-open
+RUN chmod +x /usr/local/bin/triple-c-open \
+    && for name in xdg-open sensible-browser gnome-open gvfs-open kde-open open; do \
+           ln -sf /usr/local/bin/triple-c-open "/usr/local/bin/$name"; \
+       done \
+    && dpkg-divert --local --rename --divert /usr/bin/sensible-browser.distrib \
+           --add /usr/bin/sensible-browser \
+    && ln -sf /usr/local/bin/triple-c-open /usr/bin/sensible-browser \
+    && dpkg-divert --local --rename --divert /usr/bin/xdg-open.distrib \
+           --add /usr/bin/xdg-open \
+    && ln -sf /usr/local/bin/triple-c-open /usr/bin/xdg-open \
+    && update-alternatives --install /usr/bin/x-www-browser x-www-browser \
+           /usr/local/bin/triple-c-open 200 \
+    && update-alternatives --set x-www-browser /usr/local/bin/triple-c-open \
+    && update-alternatives --install /usr/bin/www-browser www-browser \
+           /usr/local/bin/triple-c-open 200 \
+    && update-alternatives --set www-browser /usr/local/bin/triple-c-open
+
+# $BROWSER must be an image-level ENV, not just an entrypoint export: terminal
+# sessions are separate `docker exec`s, which inherit the container's config
+# env and see nothing the entrypoint exported into its own process. The
+# entrypoint additionally forwards it into the cron environment file.
+ENV BROWSER=/usr/local/bin/triple-c-open
+
 COPY triple-c-sso-refresh /usr/local/bin/triple-c-sso-refresh
 RUN chmod +x /usr/local/bin/triple-c-sso-refresh