Add optional Chrome DevTools Protocol (CDP) support per display

[Darktex]

Summary

Adds an optional cdp_port field per display that exposes Chromium's Chrome DevTools Protocol so external tools (Playwright, Puppeteer, browser automation agents, AI agents) can drive the same browser session that a human is observing over VNC. Off by default.

The motivating use case: agentic browser automation on Home Assistant OS. The agent needs CDP; the human needs VNC to watch and occasionally take over (captchas, teaching). This addon already nails the VNC + persistent-profile side beautifully — CDP is the natural complement.

Why this isn't just --remote-debugging-port=9222 in browser_args

Since Chromium M113, --remote-debugging-address=0.0.0.0 is silently downgraded to 127.0.0.1 as a security hardening measure (upstream WontFix: crbug.com/40261787). The flag passes through but the binding is loopback-only, so nothing outside the container can reach CDP — even when you publish 9222 in config.yaml, the host-side port forward points at a closed socket.

This PR works around it the same way every Chromium-in-container project does (Browserless, Playwright Docker, etc.): bind Chromium to a loopback-only internal port, then forward 0.0.0.0:cdp_port → 127.0.0.1:internal via socat. --remote-allow-origins=* is also injected — without it, modern Chromium rejects WebSocket upgrades from non-localhost callers with a 403, which silently breaks Playwright/Puppeteer (HTTP /json/version works, WS doesn't).

Changes

• Dockerfile: install socat; expose 9221-9224.
• config.yaml: add 9221-9224 to ports: (defaulted to null so they're reachable from sibling addons but not published to the host unless explicitly configured); add cdp_port: int(9221,9224)? to the per-display schema; bump version to 0.13.0.
• run_vnc.sh: when cdp_port is set on a display, strip any conflicting --remote-debugging-* flags from user-supplied browser_args, inject --remote-debugging-port=<internal> (= cdp_port + 100) and --remote-allow-origins=*, and launch a socat forwarder.
• README: document cdp_port and explain the M113+ workaround.

Backwards compatibility

Fully backwards compatible. Existing configs without cdp_port behave identically — no socat is launched, no flags injected. Users who previously put --remote-debugging-port=9222 into browser_args (which didn't actually work because of M113+) will see those flags silently stripped if they also set cdp_port, which is the safer behavior.

Test plan

• Build passes CI (docker build)
• Existing displays without cdp_port still work (no socat, no extra flags)
• With cdp_port: 9222, curl http://<addon-host>:9222/json/version returns Chromium build info
• Playwright connect_over_cdp("ws://<addon-host>:9222") connects successfully (verifies --remote-allow-origins)
• Multiple displays each get their own CDP port without collisions

🤖 Generated with Claude Code

[MindFreeze]

Thanks @Darktex