Web automation supports many administrative, academic, and commercial workflows, yet scripts built on DOM selectors break easily on single-page applications, hashed class names, and inconsistent accessibility markup. Vision-Language Models (VLMs) combined with Set-of-Mark (SoM) prompting let an agent act on screenshots and select elements by numbered reference, but most existing visual agents are single-user research prototypes tested on sanitised benchmarks, or commercial services whose safety checks depend on the model's own judgement and are exposed to indirect prompt injection. This study presents the development of a cloud-deployed vision-based web agent that combines a serverless FastAPI orchestration engine hosted on Modal, a Next.js web interface deployed to Vercel, in-container headless Chromium controlled through the Chrome DevTools Protocol, password-gated multi-tenant sessions, and a deterministic Human-in-the-Loop (HITL) safety gate whose risk classification cannot be lowered by any model output. The system is evaluated on four production websites (Google Fonts, Jiji Nigeria, Jumia Nigeria, and 10minutemail) using a four-tier test pyramid of 77 tests, with five fault types injected mid-execution. Empirical evaluation shows a 93% end-to-end resilience pass rate (14 of 15 runs), 100% recovery for every injected fault type, zero hangs and zero crashes across 52 execution steps, and a total model cost of approximately one US cent using Gemini 2.5 Flash-Lite, demonstrating that vision-based web agents with programmatic safety enforcement can operate reliably as cloud-hosted multi-tenant services.