Adolf: enable OpenClaw browser + local wiki network access

- openclaw.json: browser.enabled + noSandbox (containers can't sandbox) +
  ssrfPolicy.dangerouslyAllowPrivateNetwork (local *.alogins.net resolve to
  the private host gateway); "browser" added to gateway.tools.allow.
- docker-compose.yml: extra_hosts family.alogins.net / wiki.alogins.net ->
  host-gateway on both adolf and adolf-llm, so the gateway browser AND the
  Kimi CLI's fetch reach the local wikis (hairpin-NAT dodge, like matrix).

Enables Adolf to open + log into the family wiki (kb#64). Root 401 on the
openclaw-tools bridge was a separate fix (empty ADOLF_GATEWAY_TOKEN -> just
recreate the bridge container; no file change).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014t8Qg9gi7H7HtT8MncoXAB

adolf/openclaw.json

@@ -22,7 +22,32 @@
       // /tools/invoke surface by default. The openclaw-tools MCP bridge
       // (P5) calls that surface for cron_create/cron_list/nodes_invoke, so
       // without this allow-list those tools 404 even with a valid token.
-      allow: ["cron", "nodes"],
+      // "browser" added (kb#64 follow-up) so Adolf can drive the OpenClaw
+      // browser via the openclaw-tools bridge for authenticated web access
+      // (e.g. the family wiki login form).
+      allow: ["cron", "nodes", "browser"],
+    },
+  },
+
+  // Browser tool — bundled plugin, off by default. Enables a dedicated,
+  // agent-only headless Chromium profile ("openclaw") driven through the
+  // gateway's loopback control service. Chromium is already in the image
+  // (playwright chromium-1228). Needs both this browser.enabled=true and the
+  // "browser" entry in gateway.tools.allow above.
+  browser: {
+    enabled: true,
+    // Chromium's setuid sandbox can't initialize inside this container (no
+    // unprivileged user namespaces), so run with --no-sandbox. Safe here: the
+    // browser profile is agent-only and isolated, and the container already
+    // drops NET_RAW/NET_ADMIN. Without this, `browser start` fails with
+    // "No usable sandbox".
+    noSandbox: true,
+    // The local *.alogins.net services resolve to the host gateway (private
+    // 172.17.0.1 via extra_hosts), so the browser's SSRF guard blocks them by
+    // default ("navigation blocked by policy"). Opt in for this trusted,
+    // self-owned network — same decision as channels.matrix.network above.
+    ssrfPolicy: {
+      dangerouslyAllowPrivateNetwork: true,
     },
   },