stealth: route scripted fetch()/XHR through the wreq client

op_fetch_url backed JS fetch() and XHR with a plain reqwest/rustls client, so
in stealth mode scripted requests carried a non-browser TLS fingerprint and
none of the Chrome client hints the main navigation sends. Bot managers that
score subresource requests (the AWS WAF challenge verify call, Akamai sensors)
read that as a script and reject it. Add StealthHttpClient::send_single and a
stealth_fetch_all path that op_fetch_url uses when a stealth client is
installed, preserving the redirect, SSRF, and CORS handling so JS-level
requests share the navigation's Chrome TLS fingerprint and sec-ch-ua client
hints. The reqwest path is unchanged for non-stealth. Adds a stealth feature to
obscura-js gated on obscura-net/stealth.

crates/obscura-js/src/runtime.rs

@@ -153,6 +153,13 @@ impl ObscuraJsRuntime {
         self.state.borrow_mut().http_client = Some(client);
     }
 
+    /// Install the stealth (wreq) HTTP client so scripted fetch()/XHR is routed
+    /// through it in stealth mode (see op_fetch_url / stealth_fetch_all).
+    #[cfg(feature = "stealth")]
+    pub fn set_stealth_client(&self, client: std::sync::Arc<obscura_net::StealthHttpClient>) {
+        self.state.borrow_mut().stealth_client = Some(client);
+    }
+
     pub fn set_dom(&self, dom: DomTree) {
         self.state.borrow_mut().dom = Some(dom);
     }