feat(browser): add environment, credentials, and script logger to POST /exec

- ExecDto gains optional `environment` and `credentials` fields
- BrowserService.exec forwards both to CodeExecutorService.execute so
  helpers.env, helpers.getEnvUrl(), and helpers.getCredential() work
  identically to scenario-scheduler steps
- script console.log/warn/error now routed through TraceLogger with
  session label prefix
- integration tests cover env/creds injection and missing-alias error

server/test/browser.controller.spec.ts

@@ -135,5 +135,74 @@ describe("BrowserController", () => {
         .expect(201);
       expect(res.body).toEqual({ result: 42 });
     });
+
+    it("exposes environment via helpers.env in a named session", async () => {
+      const res = await request(app.getHttpServer())
+        .post("/exec")
+        .send({
+          sessionName: "no-such-session",
+          code: "return helpers.env.BASE_URL;",
+          environment: { BASE_URL: "https://env.example.com" },
+        })
+        .expect(201);
+      expect(res.body).toEqual({ result: "https://env.example.com" });
+    });
+
+    it("exposes environment via helpers.env in a sessionless exec", async () => {
+      const res = await request(app.getHttpServer())
+        .post("/exec")
+        .send({
+          code: "return helpers.env.KEY;",
+          environment: { KEY: "value123" },
+        })
+        .expect(201);
+      expect(res.body).toEqual({ result: "value123" });
+    });
+
+    it("exposes credentials via helpers.getCredential in a named session", async () => {
+      const res = await request(app.getHttpServer())
+        .post("/exec")
+        .send({
+          sessionName: "no-such-session",
+          code: "return helpers.getCredential('admin');",
+          credentials: { admin: { username: "user1", password: "pass1" } },
+        })
+        .expect(201);
+      expect(res.body).toEqual({
+        result: { username: "user1", password: "pass1" },
+      });
+    });
+
+    it("exposes credentials via helpers.getCredential in a sessionless exec", async () => {
+      const res = await request(app.getHttpServer())
+        .post("/exec")
+        .send({
+          code: "return helpers.getCredential('svc');",
+          credentials: { svc: { token: "abc" } },
+        })
+        .expect(201);
+      expect(res.body).toEqual({ result: { token: "abc" } });
+    });
+
+    it("throws when getCredential is called with an unknown alias", async () => {
+      const res = await request(app.getHttpServer())
+        .post("/exec")
+        .send({
+          code: "return helpers.getCredential('missing');",
+          credentials: {},
+        })
+        .expect(500);
+      expect(res.body.message).toMatch(/missing/);
+    });
+
+    it("environment and credentials default to empty when omitted", async () => {
+      const res = await request(app.getHttpServer())
+        .post("/exec")
+        .send({
+          code: "return Object.keys(helpers.env).length === 0 ? 'empty' : 'not-empty';",
+        })
+        .expect(201);
+      expect(res.body).toEqual({ result: "empty" });
+    });
   });
 });