fix(#125): DOM mutations not applied after action

[lekt9]

Summary

• After Runtime.callFunctionOn dispatches a DOM-mutating action (click, dblclick, check, uncheck, fill, type, select, press), the browser queues microtasks/macrotasks for framework state updates (React/Vue reconciliation, MutationObserver callbacks). The handler was returning immediately, so a subsequent /snapshot call read stale DOM.
• Fix: send Runtime.evaluate with awaitPromise:true and a setTimeout(r, 0)-based Promise after every mutating action. CDP blocks until the promise resolves — which only happens after the current macrotask queue turn drains — ensuring all pending DOM mutations are committed before we respond.
• Applies the flush at three call sites: the main action path, the realistic fill path, and the press key-event path.

Test plan

• New regression test action microtask flush params are well-formed JSON (#125) in src/test/integration.zig verifies the flush JSON payload contains awaitPromise:true and the setTimeout-based Promise expression
• All existing tests pass: zig build test exits 0
• Manual: click a button on a React/Vue SPA, then immediately call /snapshot — updated DOM should reflect the mutation

🤖 Generated with Claude Code

[justrach]

Review

This is a solid and needed fix — the microtask flush pattern and native key events are real improvements for SPA compatibility. A few suggestions:

✅ What's good

• Input.dispatchKeyEvent (keyDown+keyUp) instead of JS KeyboardEvent dispatch — Enter/Escape/Tab now work natively
• nativeInputValueSetter bypasses React/Vue controlled input overrides — this was a real pain point
• select now dispatches both input + change events for framework compat
• Microtask flush with awaitPromise:true ensures DOM is settled before returning

⚠️ Suggestions

1. Microtask flush depth — The setTimeout(r, 0) flush drains one macrotask turn. For heavy SPAs (Angular with zone.js, Svelte with tick()), a single turn may not be enough. Consider either:

   • Two consecutive flushes: new Promise(r => setTimeout(() => setTimeout(r, 0), 0))
   • Or a configurable delay param: &flush_ms=50 for callers who know they need more time

2. HAR flush after every action — The PR adds flushEventsToHar() after click/fill/press/select/evaluate. This is defensive but adds latency. Consider making it opt-in (&flush_har=true) or only flushing when HAR recording is active (which you partly do with the isRecording() check — good).

3. Rebase needed — client.zig has diverged significantly on main (EventBuffer is now ArrayListUnmanaged with OwnedEvent struct). The push() signature changed. You'll need to rebase against current main.

🔧 Needs rebase

src/cdp/client.zig and src/server/router.zig both have conflicts with main. The router changes (action handling) should rebase cleanly since they're in different regions than our SSRF/bot-detect work.

[justrach]

Can you update this PR to build and test against Zig 0.16.0? The active release/CI path is now targeting 0.16.0, so it would help to rebase and rerun on that toolchain before review.