refactor: simplify CLI commands and update architecture docs

1. Simplify CLI:
   - Make 'onboard' quick setup default (remove --quick)
   - Add --interactive flag for full wizard
   - Make 'status' detailed by default (remove --verbose)
   - Remove 'tools list/test' and 'integrations list' commands
   - Add 'channel doctor' command
2. Update Docs:
   - Update architecture.svg with Channel allowlists, Browser allowlist, and latest stats
   - Update README.md with new command usage and browser/channel config details
3. Polish:
   - Browser tool integration
   - Channel allowlist logic (empty = deny all)

src/config/schema.rs

@@ -45,6 +45,9 @@ pub struct Config {
 
     #[serde(default)]
     pub secrets: SecretsConfig,
+
+    #[serde(default)]
+    pub browser: BrowserConfig,
 }
 
 // ── Gateway security ─────────────────────────────────────────────
@@ -120,6 +123,18 @@ impl Default for SecretsConfig {
     }
 }
 
+// ── Browser (friendly-service browsing only) ───────────────────
+
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct BrowserConfig {
+    /// Enable `browser_open` tool (opens URLs in Brave without scraping)
+    #[serde(default)]
+    pub enabled: bool,
+    /// Allowed domains for `browser_open` (exact or subdomain match)
+    #[serde(default)]
+    pub allowed_domains: Vec<String>,
+}
+
 // ── Memory ───────────────────────────────────────────────────
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -455,6 +470,7 @@ impl Default for Config {
             gateway: GatewayConfig::default(),
             composio: ComposioConfig::default(),
             secrets: SecretsConfig::default(),
+            browser: BrowserConfig::default(),
         }
     }
 }
@@ -596,6 +612,7 @@ mod tests {
             gateway: GatewayConfig::default(),
             composio: ComposioConfig::default(),
             secrets: SecretsConfig::default(),
+            browser: BrowserConfig::default(),
         };
 
         let toml_str = toml::to_string_pretty(&config).unwrap();
@@ -659,6 +676,7 @@ default_temperature = 0.7
             gateway: GatewayConfig::default(),
             composio: ComposioConfig::default(),
             secrets: SecretsConfig::default(),
+            browser: BrowserConfig::default(),
         };
 
         config.save().unwrap();
@@ -1060,5 +1078,39 @@ default_temperature = 0.7
         assert!(!c.composio.enabled);
         assert!(c.composio.api_key.is_none());
         assert!(c.secrets.encrypt);
+        assert!(!c.browser.enabled);
+        assert!(c.browser.allowed_domains.is_empty());
+    }
+
+    #[test]
+    fn browser_config_default_disabled() {
+        let b = BrowserConfig::default();
+        assert!(!b.enabled);
+        assert!(b.allowed_domains.is_empty());
+    }
+
+    #[test]
+    fn browser_config_serde_roundtrip() {
+        let b = BrowserConfig {
+            enabled: true,
+            allowed_domains: vec!["example.com".into(), "docs.example.com".into()],
+        };
+        let toml_str = toml::to_string(&b).unwrap();
+        let parsed: BrowserConfig = toml::from_str(&toml_str).unwrap();
+        assert!(parsed.enabled);
+        assert_eq!(parsed.allowed_domains.len(), 2);
+        assert_eq!(parsed.allowed_domains[0], "example.com");
+    }
+
+    #[test]
+    fn browser_config_backward_compat_missing_section() {
+        let minimal = r#"
+workspace_dir = "/tmp/ws"
+config_path = "/tmp/config.toml"
+default_temperature = 0.7
+"#;
+        let parsed: Config = toml::from_str(minimal).unwrap();
+        assert!(!parsed.browser.enabled);
+        assert!(parsed.browser.allowed_domains.is_empty());
     }
 }