fix: add validation bounds to config schemas and fix .env.example

[ntegrals]

Summary

Adds proper bounds validation to all numeric config fields so invalid values (negative timeouts, zero-width windows, etc.) are caught at parse time instead of causing cryptic Playwright errors later.

Config validation changes

ViewportConfigSchema:

• windowWidth — .int().min(200).max(7680) (up to 8K resolution)
• windowHeight — .int().min(200).max(4320)
• minWaitPageLoadMs — .int().min(0).max(30000)
• waitForNetworkIdleMs — .int().min(0).max(30000)
• maxWaitPageLoadMs — .int().min(0).max(120000)
• minimumWaitBetweenActions — .int().min(0).max(30000)
• maxErrorLength — .int().min(50).max(10000)
• commandsPerStep — .int().min(1).max(50)
• maxIframes — .int().min(0).max(20)
• Cross-field: minWaitPageLoadMs <= maxWaitPageLoadMs

AgentConfigSchema:

• stepLimit — .int().min(1).max(1000)
• commandsPerStep — .int().min(1).max(50)
• failureThreshold — .int().min(1).max(100)
• retryDelay — .int().min(0).max(60000)
• contextWindowSize — .int().min(1000).max(2000000)
• commandDelayMs — .int().min(0).max(10000)
• strategyInterval — .int().min(0).max(100)
• stepTimeout — .int().min(1000).max(600000)
• llmTimeout — .int().min(1000).max(600000)
• maxElementsInDom — .int().min(100).max(50000)
• Cross-field: stepTimeout >= llmTimeout
• plannerModel — z.any() → z.unknown() (type-safe)

.env.example fixes

• GOOGLE_AI_API_KEY → GOOGLE_GENERATIVE_AI_API_KEY (matches what @ai-sdk/google actually reads)
• Added browser settings section (BROWSER_HEADLESS, BROWSER_BINARY_PATH, etc.)
• Added proxy settings section
• Added trace/recording path settings
• Removed undocumented OPEN_BROWSER_TIMEOUT and OPEN_BROWSER_MODEL vars

Test plan

• bun run build — all 3 packages compile clean
• bun run test — all 364 tests pass
• Default values unchanged — existing configs continue to work