fix(server): report a root preview browser as root, not AppArmor

[macodev00]

Problem

Opening a preview while the server runs as root fails because Chrome will not start its sandbox as uid 0. Playwright rewrites that abort to "Chromium sandboxing failed!", and the server reports it as an AppArmor problem. t3 browser setup then says the host is ready, so the suggested fix cannot resolve the failure.

Change

When the process uid is 0 and the sandbox is still on, launch diagnosis returns a separate root error. It names both workarounds: run the service as a nonroot User=, or set T3CODE_SERVER_BROWSER_SANDBOX=0. It does not mention AppArmor or t3 browser setup.

t3 browser setup warns about that same condition instead of saying the host is ready. A sudo invocation from a non-root user still reports ready when the AppArmor and library checks pass, because that process is root only for setup. Non-root AppArmor and library diagnosis is unchanged.

The server also logs the root warning at startup, before a tab is opened.

Scope and approval

Fixes pingdotgg#18938. The accepted scope on that issue is the root diagnosis and the setup ready message.

Verification

vp test run on:

• apps/server/src/preview/PreviewBrowserHost.test.ts
• apps/server/src/cli/browser.test.ts
• apps/server/src/preview/ServerBrowserStream.test.ts

25 tests passed. A root process with the sandbox on reports the root error and does not mention AppArmor or browser setup. A non-root sandbox failure still reports AppArmor. Setup for a root service prints the warning; setup for a non-root user, and sudo setup for a non-root user, still prints ready. Server package typecheck reported no errors.

Fixes pingdotgg#18938

Model and harness: Grok 4.7 (high effort) in a Cursor Cloud Agent.