Browser-native C2 research lab demonstrating XSS, Service Worker persistence, and HTTP polling tradecraft