Add Lightpanda browser services and automation scripts

Add lightpanda-cdp and lightpanda-mcp services for local (Tilt) and
production (deploy/prod/) with Traefik routing, HPAs, and CI image
publishing. Create scripts for concurrent Bing search via MCP and
CDP screenshots. Update flake.nix with websocat dependency. Make
webshare-secret helper tolerant of missing Doppler credentials.

services/lightpanda-mcp/Dockerfile

@@ -0,0 +1,21 @@
+# --- Lightpanda MCP Service Dockerfile ---
+# Exposes Lightpanda's stdio MCP server over Streamable HTTP for remote agents.
+
+FROM lightpanda/browser:nightly AS lightpanda
+
+FROM oven/bun:1.3.0-debian
+
+RUN apt-get update -yq && \
+    apt-get install -yq --no-install-recommends ca-certificates tini && \
+    rm -rf /var/lib/apt/lists/*
+
+RUN bun add --global [email protected]
+
+COPY --from=lightpanda /bin/lightpanda /usr/local/bin/lightpanda
+
+ENV LIGHTPANDA_DISABLE_TELEMETRY=true
+
+EXPOSE 8000
+
+ENTRYPOINT ["/usr/bin/tini", "--"]
+CMD ["supergateway", "--stdio", "lightpanda mcp", "--outputTransport", "streamableHttp", "--stateful", "--sessionTimeout", "180000", "--streamableHttpPath", "/mcp", "--healthEndpoint", "/healthz", "--port", "8000", "--logLevel", "info"]