feat(hrafn): register the browser-fetch service and tighten its env perms

nevermore-claude handed hrafn to infra-ops for uptime ownership. Intake:
verified health independently, brought it into the inventory, and fixed one
security defect found during the check.

- canonicalize stacks/hrafn/ (compose.yaml + .env.example + README)
- list hrafn in the ana-docker running-stacks table
- README records the load-bearing bits: shm_size 1gb is required for
  Chromium, playwright and the base image are version-coupled, SSRF denies
  private targets by default, and restart:unless-stopped does NOT act on
  healthcheck failure

Security fix applied on the host, not in this tree: /opt/docker/compose/
hrafn/.env was 0644 with a live 57-char bearer token in it, readable by
every local account (verified by reading it as `nobody`). Tightened to 0600;
owner unchanged so the deploy path still works, confirmed via `docker
compose config` as lkraven. Container untouched and still healthy.

Known gaps recorded rather than silently accepted: no CI deploy, and the
image builds from an rsync'd working tree living in the compose directory,
so the running image has no commit provenance.

servers/ana-docker/README.md

@@ -50,6 +50,7 @@ General-purpose Docker host for the Anaheim colo. Runs everything at `10.250.0.0
 | restic rest-server | 8000 | Anaheim-side restic endpoint (writes to the NFS mount at `/mnt/backup/restic/repo/ana/`, backed by the Debian file server at `10.250.50.50`); paired with `rest-server-nh3` on the Synology for the NH3 side |
 | backrest | 9898 | Fleet-wide restic snapshot viewer / restore UI — points at both rest-servers |
 | it-tools | 8780 | Dev utilities |
+| hrafn | internal only | Browser-fetch service (real Chromium behind a REST API) for bot-gated sites; consumers reach `http://hrafn:8080` on `traefik-net`. No host port by design. See `stacks/hrafn/` |
 | mattermost | — | Stopped; kept around for reference |
 
 Portainer was retired from this host; stack management is now handled via Dockge + Beszel.