web: install Google Chrome for the Browse Lite extension

Browse Lite (antfu.browse-lite, kept in the earlier Open VSX audit)
launches an embedded browser preview via a real Chrome/Chromium binary,
which templates/web's image never provided - it failed with "No Chrome
installation found, or no Chrome executable set in the settings".

Ubuntu's own chromium-browser apt package is a snap wrapper and doesn't
work in a container, so this installs Google Chrome's official .deb
instead (amd64 only, matching this repo's single x86_64 Docker host).
Also points browse-lite.chromeExecutable at it explicitly rather than
relying on auto-detection.

Verified the new apt-key/repo/install layer builds cleanly in isolation
on octo-winsrv (google-chrome-stable 152.0.7977.64).

templates/web/Dockerfile

@@ -17,6 +17,19 @@ ENV LANG=en_US.UTF-8 \
     LANGUAGE=en_US:en \
     LC_ALL=en_US.UTF-8
 
+# Google Chrome (stable), for the Browse Lite VS Code extension's embedded
+# browser preview. Ubuntu's own `chromium-browser` apt package is just a
+# snap wrapper and doesn't work in a container (no snapd) - Google's own
+# .deb is the reliable way to get a real Chrome binary here. amd64 only
+# (Google doesn't publish a Chrome .deb for arm64), which matches this
+# repo's single x86_64 Docker host.
+RUN curl -fsSL https://dl.google.com/linux/linux_signing_key.pub \
+        | gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg \
+    && echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" \
+        > /etc/apt/sources.list.d/google-chrome.list \
+    && apt-get update && apt-get install -y google-chrome-stable \
+    && rm -rf /var/lib/apt/lists/*
+
 # Core build toolchain, crypto/DB headers, Tauri 2 / WebKit GUI prerequisites,
 # X11 dev libs, DB CLI clients, Python + OpenCV, protobuf compiler.
 RUN apt-get update && apt-get install -y --no-install-recommends \