fix(auth): target visible duplicate login fields

[zyz619963502zyz]

Summary

• select the first visible, enabled, non-readonly auth control across all matching elements instead of checking only the selector's first match
• preserve that exact backend node identity through fill/click, repoll transient resolution races, and fail safely if the node becomes stale
• add real-browser regressions for hidden-first username, password, and submit controls

Closes #1998

Regression evidence

On the prior implementation, the three Rust 1.88 + Chromium 154/CDP scenarios failed deterministically (0 passed, 3 failed): username, password, and submit each timed out when a hidden matching element preceded the visible control. With this change, the same scenarios pass (3 passed, 0 failed) and assert that hidden inputs remain empty, the hidden submit is not clicked, and the visible form is filled and submitted.

Validation

• cargo fmt -- --check
• cargo check --bin agent-browser
• cargo clippy --bin agent-browser (passes with existing warnings)
• cargo test --bin agent-browser -- --test-threads=1 (1393 passed, 0 failed, 145 ignored)
• Rust 1.88 + Chromium 154/CDP duplicate-control regressions (3 passed)
• no-navigation auth state and delayed SPA form regressions (2 passed)
• element unit tests (18 passed)

The publication preflight completed with no blocking findings. Its only warning was 47 deleted lines from the intentional replacement of the old single-node helper; the committed diff was manually reviewed, contains no deleted files, and the worktree was clean.

[vercel]

@zyz619963502zyz is attempting to deploy a commit to the Vercel Labs Team on Vercel.

A member of the Team first needs to authorize it.