Fail closed for unsupported browser CUG modes

[RobLe3]

Summary

Resolves the safe-disposition part of #22 without claiming browser CUG support.

• adds an explicit browser operating-mode type;
• preserves public as the compatibility default;
• rejects private, federated_private, local_only, and custom during consumer/provider construction;
• uses the stable bounded reason restricted_profile_unsupported;
• proves refusal occurs before discovery, registration, or relay traffic;
• documents that the package does not persist membership credentials or downgrade private requests to the public directory.

This is intentionally a refusal boundary. A future full browser CUG design still requires a separately reviewed WebCrypto and credential-lifecycle model.

Evidence

• npm run typecheck — passed
• npm test — 57 passed
• npm run build — passed
• npm run package:audit — passed
• git diff --check — passed

Sentrux has no committed baseline or rules in this standalone repository, so no baseline was created merely to make a gate pass.