docs: link egress from portal capabilities

docs/features/capabilities.md

@@ -116,6 +116,12 @@ Test runners that read `BROWSER` or `CHROME_BIN` (Vitest, Playwright, etc.)
 work without extra plumbing. If a browser is requested but no binary is
 found, the run aborts before the command starts.
 
+For browser QA where the remote service is sensitive to source IP (Discord
+login, Slack workspace bootstrap, regional CDN behavior), pair `--browser`
+with [mediated egress](egress.md). `crabbox egress start` opens a lease-local
+proxy that exits to the internet through the operator machine, and `crabbox
+desktop launch --egress <profile>` passes that proxy to Chrome.
+
 ## Code
 
 `--code` provisions code-server on managed Linux leases:
@@ -187,5 +193,7 @@ Related docs:
 - [vnc command](../commands/vnc.md)
 - [webvnc command](../commands/webvnc.md)
 - [code command](../commands/code.md)
+- [egress command](../commands/egress.md)
 - [Interactive desktop and VNC](interactive-desktop-vnc.md)
+- [Mediated egress](egress.md)
 - [Browser portal](portal.md)

docs/features/portal.md

@@ -62,22 +62,30 @@ visibility-only detail page.
 The lease detail page shows:
 
 - compact provider/target badges and the lease state pill;
-- bridge status (whether the WebVNC and code-server bridges are up);
+- bridge status for the WebVNC, code-server, and mediated egress bridges,
+  including host/client connection state for an active egress session;
 - the latest Linux telemetry sample as gauges, with sparklines when multiple
   samples are present;
 - stale-telemetry, high-load, high-memory, and high-disk status pills when
   thresholds are exceeded;
 - an access panel with copy-to-clipboard commands for `crabbox ssh`,
-  `crabbox run`, `crabbox webvnc`, and `crabbox code`;
+  `crabbox run`, `crabbox webvnc`, `crabbox code`, and (when an egress
+  session is active) `crabbox egress status` / `crabbox egress stop`;
 - a viewport-fitted "recent runs" grid with state filters;
 - a stop action when the lease is releasable.
 
 `/portal/leases/{id-or-slug}/vnc` and `/portal/leases/{id-or-slug}/code/`
 are bridges, not portal pages. They proxy WebSocket and HTTP traffic to the
 matching capability on the lease so a user does not need an SSH tunnel to
-open the desktop or editor. See
-[Interactive desktop and VNC](interactive-desktop-vnc.md) and
-[code command](../commands/code.md).
+open the desktop or editor. The mediated egress bridge has its own
+ticketed websocket route under `/v1/leases/{id-or-slug}/egress/...` rather
+than a portal path, because egress is operator-driven and never opens an
+HTML view. See [Interactive desktop and VNC](interactive-desktop-vnc.md),
+[code command](../commands/code.md), and [Mediated egress](egress.md).
+
+All bridge tickets travel as `Authorization: Bearer ...` headers on the
+agent websocket upgrade, with a `?ticket=` query string fallback for older
+CLIs. The portal never echoes ticket values back to the browser.
 
 ## Run Detail `/portal/runs/{run-id}`