fix: creepjs stealth, AudioBuffer, Crypto, Worker, hasIframeProxy

Worker auto-execution: Worker constructor resolves relative URLs against
location.href, fetches the script, and auto-runs it. WorkerGlobalScope is
exposed so IS_WORKER_SCOPE resolves correctly. Worker data (navigator,
locale, timezone) now arrives via postMessage within the 3s timeout.

AudioBuffer class added to globalThis with getChannelData, copyFromChannel,
copyToChannel. AudioContext.createBuffer returns a real AudioBuffer. Fixes
ReferenceError that blocked the audio fingerprint section.

Crypto class added to globalThis with randomUUID and getRandomValues on its
prototype. Fixes ReferenceError in getPlatformEstimate.

AudioContext.addEventListener was a no-op; startRendering only fired
oncomplete. Add _listeners map and dispatch to stored listeners.

getElementById and querySelector('#id') returned null for elements inserted
via replaceChild(documentFragment, el). id_index only registers nodes at
creation time; .or_insert skipped IDs on cloned fragments; None caused
query_selector_from to short-circuit the full scan.
Fix querySelector: fall through to full scan on index miss or stale entry.
Fix getElementById: verify node is in live document; fall back to attribute
selector scan if not.

contentWindow getter: return null when parentNode is null (iframe was never
inserted into any tree). Previously returning null for all disconnected
iframes broke getBehemothIframe, which caused PHANTOM_DARKNESS to fall back
to self (main window) instead of the phantom iframe. That made DOC point to
the main document, so rect and font measurements wrote fragment nodes into
the main body, and the subsequent full-DOM scan in getElementById could not
find fingerprint-data through nested fragments in time.

Limiting the null return to parentNode===null (never inserted) means
getBehemothIframe gets a valid nested contentWindow as expected. creepjs
now reports hasIframeProxy: false and 0% stealth detection.

DocumentFragment constructor: pass nid through when provided.
Range.getBoundingClientRect / getClientRects: return commonAncestor rect.

crates/obscura-js/src/ops.rs

@@ -137,7 +137,21 @@ fn op_dom_inner(state: &OpState, cmd: String, arg1: String, arg2: String) -> Str
             "null".into()
         }
         "get_element_by_id" => {
-            dom.get_element_by_id(&arg1).map(|id| id.index().to_string()).unwrap_or("-1".into())
+            // Verify the indexed node is in the live document. The id_index is best-effort:
+            // it only registers nodes at creation time and doesn't update on reparent, so
+            // it can point to a detached clone while the live node is elsewhere in the tree.
+            let doc = dom.document();
+            let nid = dom.get_element_by_id(&arg1);
+            let live = nid.filter(|&n| dom.ancestors(n).contains(&doc));
+            match live {
+                Some(n) => n.index().to_string(),
+                None => {
+                    // Fall back to full scan for the live document.
+                    let sel = format!("[id=\"{}\"]", arg1.replace('\\', "\\\\").replace('"', "\\\""));
+                    dom.query_selector(&sel).ok().flatten()
+                        .map(|id| id.index().to_string()).unwrap_or("-1".into())
+                }
+            }
         }
         "query_selector" => {
             dom.query_selector(&arg1).ok().flatten().map(|id| id.index().to_string()).unwrap_or("-1".into())
@@ -235,19 +249,22 @@ fn op_dom_inner(state: &OpState, cmd: String, arg1: String, arg2: String) -> Str
             serde_json::to_string(&dom.outer_html(NodeId::new(nid))).unwrap_or("\"\"".into())
         }
         "append_child" => {
-            let parent = arg1.parse::<u32>().unwrap_or(0);
-            let child = arg2.parse::<u32>().unwrap_or(0);
+            // Reject if either nid failed to parse (was "undefined"/empty) — those
+            // default to 0 which is the document root, and silently operating on it
+            // corrupts the tree. Require both args to be valid positive integers.
+            let parent = match arg1.parse::<u32>() { Ok(n) => n, Err(_) => return "false".into() };
+            let child = match arg2.parse::<u32>() { Ok(n) => n, Err(_) => return "false".into() };
             dom.append_child(NodeId::new(parent), NodeId::new(child));
             "true".into()
         }
         "remove_child" => {
-            let child = arg1.parse::<u32>().unwrap_or(0);
+            let child = match arg1.parse::<u32>() { Ok(n) => n, Err(_) => return "false".into() };
             dom.remove_child(NodeId::new(child));
             "true".into()
         }
         "insert_before" => {
-            let new_node = arg1.parse::<u32>().unwrap_or(0);
-            let ref_node = arg2.parse::<u32>().unwrap_or(0);
+            let new_node = match arg1.parse::<u32>() { Ok(n) => n, Err(_) => return "false".into() };
+            let ref_node = match arg2.parse::<u32>() { Ok(n) => n, Err(_) => return "false".into() };
             dom.insert_before(NodeId::new(ref_node), NodeId::new(new_node));
             "true".into()
         }
@@ -261,7 +278,12 @@ fn op_dom_inner(state: &OpState, cmd: String, arg1: String, arg2: String) -> Str
             "true".into()
         }
         "set_inner_html" => {
-            let nid = arg1.parse::<u32>().unwrap_or(0);
+            let nid = match arg1.parse::<u32>() {
+                Ok(n) if n > 0 => n,
+                // nid=0 is the document root; never allow innerHTML to clear it.
+                // nid parse failure (e.g. "undefined") also falls here.
+                _ => return "false".into(),
+            };
             let target = NodeId::new(nid);
             let children = dom.children(target);
             for child in children {