[BF-022] Pipeline Builder 入口、本地预设和工作流模板 - #81

Issue

Closes #42

Scope

• Add visible Pipeline Builder entry points from the desktop navbar, mobile navigation, and localized home hero.
• Make Pipeline Builder saved recipes, exported JSON, and shared URLs use portable recipe data that strips runtime payloads and non-public options.
• Add task-oriented built-in recipes for API payload cleanup, URL JSON cleanup, security token review, log scrub before sharing, and copied config cleanup.
• Show step input/output handoff text and a manifest-driven external-request step warning branch.

Implementation

• Added createPortableRecipe and routed share, export, and IndexedDB saved records through it.
• Updated Pipeline Builder copy in all locales to state that save/export/share exclude runtime input.
• Expanded unit/component/e2e coverage for templates, save/load, import/export, execution, and payload stripping.
• Refreshed sitemap lastmod for the localized home pages changed by the new hero entry.

Validation

• npm run lint - PASS
• npm run test - PASS (217 files, 1088 tests)
• npm run validate - PASS
• npm run build - PASS (1289 static pages, post-build SEO/i18n/security gates)
• npm run test:e2e:smoke - PASS

Manual Checks

• Pipeline Builder has visible desktop navbar, mobile nav, and home hero entries.
• Saved recipe flow keeps workflow structure while stripping runtime input from IndexedDB.
• Exported recipe JSON strips runtime input and can be imported back.
• Built-in recipe templates load and run locally.
• External-request step warning branch is covered by component test.

Privacy Check

• 不采集工具输入
• 不采集工具输出
• 不新增未披露的外部请求
• 不持久化敏感 payload

Acceptance Criteria

• Pipeline Builder 有显眼入口。
• 用户可保存本地 recipe，但不保存 payload。
• 用户可导入/导出 recipe JSON。
• 至少 3 个官方模板可用。
• 外部请求步骤有提示。
• npm run test:e2e:smoke、npm run validate、npm run build 通过。

Screenshots / Evidence

• output/playwright/bf022-home-pipeline-entry.png
• output/playwright/bf022-pipeline-builder-templates.png

Note: current Pipeline Builder adapters are browser-local text/structured-data adapters. The external-request warning is manifest-driven and covered by test so future external-request adapters will surface the warning automatically.