fix(browser,cdp,js): about:blank navigation, real getBoxModel/getContentQuads, expose _wrap and self

- about: URL scheme now handled in navigate_single instead of
  hitting validate_url and failing with "Forbidden URL scheme"
- DOM.getBoxModel calls getBoundingClientRect via JS instead of
  returning hardcoded pixel coords
- DOM.getContentQuads added (was missing, needed by Playwright click)
- globalThis._wrap exposed so CDP eval code can look up nodes by id
- globalThis.self = globalThis for webpack/bundler worker detection

crates/obscura-js/js/bootstrap.js

@@ -1076,6 +1076,9 @@ function _wrapEl(nid) {
   return n;
 }
 
+globalThis._wrap = _wrap;
+globalThis.self = globalThis;
+
 globalThis.document = null;
 function _resolveUrl(url) {
   if (!url) return url;