Implement recording session creation, validation, and browser launch with allow-list enforcement

[kalen-releasedgroup]

Summary

Deliver the recording session entry point and safe browser startup flow through the real UI so developers can visually validate the first workflow locally.

Scope

• Implement recording session creation from the UI and internal API.
• Validate scenario name, environment, target URL, browser selection, and auth bootstrap mode.
• Launch Playwright only after server-side permission and allow-list checks pass.
• Ensure the recording entry flow works in the local production-like developer environment.

Requirement Links

• FR-REC-001, FR-REC-002
• Sections 5.3.1, 9.2, 12.4, 12.6, 14.1, 16.2
• Acceptance Criteria 1, 11, and 13

Dependencies

• Sprint 1 host shell and allow-list management

Exit Criteria

• Users can request a recording session from the UI.
• Invalid or disallowed targets fail before browser launch.
• Recording session state is persisted and observable.
• Developers can visually validate the recording entry workflow locally before push.