fix(gateway): honor browser profile from request body for node proxy calls

Gateway browser.request only read profile from query.profile before invoking
browser.proxy on nodes. Calls that passed profile in POST body silently fell
back to the default profile, which could switch users into chrome extension
mode even when they explicitly requested openclaw profile.

Use query profile first, then fall back to body.profile when present.

Closes #28687

src/gateway/server-methods/browser.ts

@@ -20,6 +20,25 @@ type BrowserRequestParams = {
   timeoutMs?: number;
 };
 
+function resolveRequestedProfile(params: {
+  query?: Record<string, unknown>;
+  body?: unknown;
+}): string | undefined {
+  const queryProfile =
+    typeof params.query?.profile === "string" ? params.query.profile.trim() : undefined;
+  if (queryProfile) {
+    return queryProfile;
+  }
+  if (!params.body || typeof params.body !== "object") {
+    return undefined;
+  }
+  const bodyProfile =
+    "profile" in params.body && typeof params.body.profile === "string"
+      ? params.body.profile.trim()
+      : undefined;
+  return bodyProfile || undefined;
+}
+
 type BrowserProxyFile = {
   path: string;
   base64: string;
@@ -187,7 +206,7 @@ export const browserHandlers: GatewayRequestHandlers = {
         query,
         body,
         timeoutMs,
-        profile: typeof query?.profile === "string" ? query.profile : undefined,
+        profile: resolveRequestedProfile({ query, body }),
       };
       const res = await context.nodeRegistry.invoke({
         nodeId: nodeTarget.nodeId,