feat: split-deployment roles (browser-host on LAN + remote bot)

Add JARVIS_ROLE (full|browser|bot) via a run-if-role.sh supervisord guard so
one image serves three layouts. Make Chrome CDP bind configurable (CDP_BIND)
and publishable on the LAN (CDP_PUBLISH_BIND) so a bot on another PC can drive
this host's on-screen Chrome over the internal network (no auth, as requested).

docker/run-chrome.sh

@@ -19,7 +19,7 @@ exec google-chrome \
   --disable-translate \
   --disable-features=Translate,TranslateUI,InfoBars \
   --remote-debugging-port="${CDP_PORT:-9222}" \
-  --remote-debugging-address=127.0.0.1 \
+  --remote-debugging-address="${CDP_BIND:-127.0.0.1}" \
   --user-data-dir="${CHROME_PROFILE_DIR:-/root/chrome-profile}" \
   --password-store=basic --start-maximized \
   "${CHROME_START_URL:-about:blank}"