feat(hrafn): register the browser-fetch service and tighten its env perms

nevermore-claude handed hrafn to infra-ops for uptime ownership. Intake:
verified health independently, brought it into the inventory, and fixed one
security defect found during the check.

- canonicalize stacks/hrafn/ (compose.yaml + .env.example + README)
- list hrafn in the ana-docker running-stacks table
- README records the load-bearing bits: shm_size 1gb is required for
  Chromium, playwright and the base image are version-coupled, SSRF denies
  private targets by default, and restart:unless-stopped does NOT act on
  healthcheck failure

Security fix applied on the host, not in this tree: /opt/docker/compose/
hrafn/.env was 0644 with a live 57-char bearer token in it, readable by
every local account (verified by reading it as `nobody`). Tightened to 0600;
owner unchanged so the deploy path still works, confirmed via `docker
compose config` as lkraven. Container untouched and still healthy.

Known gaps recorded rather than silently accepted: no CI deploy, and the
image builds from an rsync'd working tree living in the compose directory,
so the running image has no commit provenance.

stacks/hrafn/compose.yaml

@@ -0,0 +1,25 @@
+# hrafn — internal fleet service. No published host port; consumers reach
+# it at http://hrafn:8080 on the shared network (contract § Deployment).
+services:
+  hrafn:
+    build: .
+    image: local/hrafn:${HRAFN_TAG:-v1}
+    container_name: hrafn
+    restart: unless-stopped
+    env_file: .env
+    networks:
+      - traefik-net
+    # Chromium wants a larger shared-memory segment than Docker's 64MB
+    # default or it crashes on some pages.
+    shm_size: "1gb"
+    healthcheck:
+      test: ["CMD", "python", "-c",
+             "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8080/readyz').status==200 else 1)"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 20s
+
+networks:
+  traefik-net:
+    external: true