Keep rule-help browser fixtures on their intended request paths

Serve a harmless 404 for browser favicon requests and bind synthetic session requests to their recorded user agent. Retain the earlier browser setup failure.

Contract-Neutral: Synthetic proof-fixture preparation only; no runtime or rule-removal instructions changed.
Change-source: pulse-maintainer

frontend-modern/browser-tests/patrol-rule-help.cjs

@@ -32,7 +32,10 @@ const server = http.createServer((request, response) => {
       <pre style="white-space:pre-wrap;max-width:1000px">${escape(snippet)}</pre>`);
     return;
   }
-  assert.ok(request.url.startsWith('/api/ai/patrol/suppressions'));
+  if (!request.url.startsWith('/api/ai/patrol/suppressions')) {
+    response.writeHead(404).end();
+    return;
+  }
   const hasSession = (request.headers.cookie || '').includes('pulse_session=synthetic-session');
   const expectedOrg = request.headers['x-pulse-org-id'] === 'org-a';
   const validCSRF = request.headers['x-csrf-token'] === 'synthetic-csrf';

internal/api/patrol_suppression_management_test.go

@@ -31,6 +31,7 @@ func TestPatrolSuppressionManagementBrowserSession(t *testing.T) {
 		t.Helper()
 		req := httptest.NewRequest(method, path, nil)
 		req.RemoteAddr = "127.0.0.1:12345"
+		req.Header.Set("User-Agent", "test-agent")
 		req.Header.Set("X-Requested-With", "XMLHttpRequest")
 		req.Header.Set("X-Pulse-Org-ID", "default")
 		if authenticated {