sec(slm): browser MCP endpoints missing authentication (navigate, screenshot)

[mrveiss]

Problem

`autobot-slm-backend/api/browser.py` exposes three unauthenticated endpoints:

• `GET /browser/mcp/status`
• `POST /browser/mcp/navigate` — navigates the server's browser to any URL
• `POST /browser/mcp/screenshot` — captures and returns a screenshot

No `get_current_user` or `require_admin` dependency is present on the router
or any individual route. An unauthenticated caller can:

1. Navigate the server browser to arbitrary URLs (SSRF vector)
2. Retrieve screenshots of whatever the browser currently shows

Fix

Add router-level auth:
```python
from services.auth import get_current_user
router = APIRouter(
prefix="/browser/mcp",
tags=["browser"],
dependencies=[Depends(get_current_user)],
)
```

`/status` may remain unauthenticated if needed for health checks, but
`/navigate` and `/screenshot` must require authentication.

Discovery

Found during auth coverage audit triggered by PR #3438 (#3423 fix).

[mrveiss]

Fixed in PR #3460.