Implement managed browser security, individual agents and observability

apps/browser/enterprise-inspection.cjs

@@ -28,7 +28,7 @@ async function scanDownloadEnterprise(bytes,policy,localInspector,scanner){
   if(noAv&&!policy.fileTransfers?.download?.allowWithoutMalwareScanner)return blocked('malware-scanner-required');
   // Antivirus clean does not classify company secrets. Supported documents always
   // require the contained DLP parser; explicit no-antivirus mode still requires DLP.
-  if(noAv||policy.dlp?.semantic?.enabled||['pdf','zip','png','jpeg','gif','webp','text'].includes(detectType(bytes))){
+  if(noAv||(policy.fileTransfers?.download?.requireDocumentDlp!==false&&(policy.dlp?.semantic?.enabled||['pdf','zip','ole','png','jpeg','gif','webp','text'].includes(detectType(bytes))))){
     if(!localInspector?.inspect)return blocked('download-dlp-unavailable');
     let dlp;try{dlp=await localInspector.inspect(bytes,policy);}catch{return blocked('download-dlp-unavailable');}
     if(dlp.decision!=='allow')return blocked(typeof dlp.ruleId==='string'?dlp.ruleId:'download-dlp-blocked');