feat(session): add enableWebBotAuth flag

[devin-ai-integration]

Summary

Adds a new optional enableWebBotAuth boolean to CreateSessionParams and SessionLaunchState in src/types/session.ts. The field is a passthrough to the existing POST /api/session endpoint — no changes to src/services/sessions.ts are needed since it already JSON-serializes params verbatim.

When set to true, the server signs every outbound HTTP request from the browser session using Hyperbrowser's Cloudflare-verified bot identity per draft-meunier-web-bot-auth-architecture-02 and RFC 9421. The flag is mutually exclusive with useStealth and useUltraStealth.

This PR is the SDK-surface part of the rollout. Companion PRs:

• hyperbrowserai/python-sdk — enable_web_bot_auth field
• hyperbrowserai/docs — sessions/web-bot-auth.mdx, OpenAPI schema, parameters reference
• hyperbrowserai/marketing-site — /.well-known/http-message-signatures-directory JWKS endpoint, blog post, changelog entry

The actual request signing + key management lives in metlo-labs/browserctrl (out of scope for this PR).

Review & Testing Checklist for Human

• Confirm the enableWebBotAuth name choice (vs alternatives like webBotAuth: true or an identity enum). The plan picks enableWebBotAuth to match the existing enable* flag convention (enableWebRecording, enableLogCapture, etc.).
• Confirm SDK ships before, after, or alongside the server-side signing work in browserctrl.

Notes

yarn lint and yarn build both pass.

Link to Devin session: https://app.devin.ai/sessions/10a58e30bd3e4ec58906f25eab6762a5
Requested by: @shrisukhani

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 1 additional finding.