[albanm]

Add GET /api/v1/inspect, an internal endpoint that renders a page with the caller's cookies and returns { image, text, report }: a PNG screenshot, a text report in the format of Playwright MCP, and the same report structured.

• The report gives the page URL, title, HTTP status and readiness (triggered, idle, timeout), plus a verdict (ok, errors, timeout, unauthenticated).
• It lists console and page errors, failed same-origin requests (with a short body excerpt) and cross-host frames, which are blocked and not rendered. Browser noise is left out: favicon requests, aborted fetches, Chrome's duplicate "Failed to load resource" lines.
• The page's accessibility snapshot comes in Playwright's YAML format, with its own budget (20,000 characters, 200 links, long texts cut). Console and network share an 8,000-character budget.
• declaredErrorUrl (same host as target): the page's POST requests to this URL are answered with 204 by capture and never sent, and their message is reported under declaredErrors. This is how data-fair applications declare their configuration errors.
• Options: mobile, fullPage (clipped at 3000px), width/height, lang, timezone.
• Bounds: INSPECT_CONCURRENCY (default 1) caps simultaneous renders. A render is skipped when the client left while queued. A main frame that navigates away from the target host makes the verdict errors.
• Access: internal requests only, with their own secret SECRET_INSPECT. The endpoint is disabled without it, and enabling it doesn't lock /screenshot and /print, which keep SECRET_CAPTURE.

Why: data-fair's preview_application and portals' preview_portal_page agent tools let autonomous agents see what they configured. An agent needs the picture and a textual diagnosis it can read, not just a screenshot.

Heads-up:

• /screenshot and /print go through the same openInPage and waitForPage, which now return the readiness and accept the inspect options. Without those options their behavior is unchanged, but this shared path is the part to review hardest.
• Deploy: set SECRET_INSPECT on capture to the SECRET_CAPTURE value of data-fair and portals, and leave capture's SECRET_CAPTURE unset while browsers and other services call /screenshot and /print directly. Callers must reach capture through its internal service URL: /inspect refuses requests carrying x-forwarded-host.