Replace Chrome-remote-debugging login capture with a cookie-paste import flow

Live testing showed the CDP approach still fails hCaptcha even with a
real human clicking through chrome://inspect: the headless Chromium's
own fingerprint (HeadlessChrome user-agent, navigator.webdriver=true)
is what gets flagged, independent of who's driving it. Trying to
disguise that browser to get past bot detection would be captcha
evasion, not a session-handling technique, so that path is dropped
entirely rather than patched further.

New flow: log into MassPrice with an ordinary, non-automated browser
(hCaptcha passes normally), export the session's cookies with a
extension, and paste them into the Session page. import_cookies()
converts the export into Playwright's storage_state shape and verifies
it actually authenticates against the live site before saving it,
so a bad paste never clobbers a working session. This also removes the
now-unnecessary socat proxy / debug port exposure — Chromium's own
CDP port was only ever needed for the dropped approach.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H6TgffxTvYhqxykAbVQg2v

.claude/skills/deploy-massprice/SKILL.md

@@ -9,8 +9,7 @@ description: Use when deploying MassPrice Scheduler, restarting the massprice co
 built from `Dockerfile`/`docker-compose.yml` in this repo. Container name
 `massprice`, port `5057` (overridable via `HOST_PORT` — `5056` was
 already taken by `arr-summary`, despite its own docs saying `5055`) →
-container port `5000`. Also exposes `DEBUG_PORT` (default `9222`) for the
-Chrome-remote-debugging login flow — see below.
+container port `5000`.
 
 **Deploy mechanism: Forgejo push-to-deploy**, the same pattern as
 `arr-summary`, `card-grader`, `lunch-notifier`, `n64-tracker` — see
@@ -39,14 +38,16 @@ cd /mnt/user/appdata/massprice && docker compose restart
 
 1. Create `/mnt/user/appdata/massprice` on Unraid and a real `.env`
    there (copy `.env.example`, fill in `LOGIN_PASSWORD`, `SECRET_KEY`,
-   `HOST_PORT`, `DEBUG_PORT`, `TZ`).
+   `HOST_PORT`, `TZ`).
 2. First `docker compose up -d --build` — confirm the container starts
    and `/login` responds on `HOST_PORT`.
 3. Log into the webui, go to the **Session** page, and follow its
-   instructions: click "Start Login Session", connect your own Chrome to
-   `<unraid-ip>:<DEBUG_PORT>` via `chrome://inspect`, log in (solving the
-   hCaptcha yourself — this cannot be automated, see `CLAUDE.md`), then
-   click "Capture Session" back in the webui.
+   instructions: log into massprice.tcgplayer.com in your own regular
+   Chrome, export its cookies with the Cookie-Editor extension, paste
+   them into the box, and click "Import Session". MassPrice's login is
+   behind hCaptcha, which blocks any form of automated login (confirmed
+   by testing — see `CLAUDE.md`), so this manual export is the only path
+   in, and needs repeating whenever the session eventually expires.
 4. Click "Refresh Rules" on the Dashboard — confirms the saved session
    actually works and pulls the real rule list.
 5. Set up at least one schedule and use "Run Now" once to confirm a
@@ -62,8 +63,9 @@ cd /mnt/user/appdata/massprice && docker compose restart
 
 `.env` holds `LOGIN_PASSWORD` and `SECRET_KEY`. `data/` (bind-mounted to
 `/data`) holds `schedules.json` (the schedules set from the webui),
-`auth_state.json` (the saved MassPrice browser session captured via the
-Session page — losing this just costs one re-login, not data),
+`auth_state.json` (the saved MassPrice session imported via the Session
+page — a live bearer credential for the user's MassPrice account while
+valid, see `CLAUDE.md`; losing this just costs one re-import, not data),
 `run_history.json`, and `rules_cache.json`. Both are excluded from the
 deploy rsync (which runs `--delete`) and from git.
 
@@ -81,8 +83,11 @@ Check, in order:
 3. **Timezone** — `TZ` in `.env` controls what "6:00 AM" means for every
    schedule; confirm it matches what the user actually expects before
    assuming a schedule itself is wrong.
-4. **Session capture stuck at "Still not logged in"** — the debug
-   session's page needs to actually be on `/Rule/List` or somewhere under
-   `/Rule` after login for the capture check to pass; if the inspected
-   tab is still sitting on the marketing homepage or the OAuth login
-   page, finish clicking through to the dashboard/rules first.
+4. **Session import fails with "didn't authenticate"** — the export was
+   probably taken from the wrong tab or before login finished. Re-export
+   only after you're actually looking at massprice.tcgplayer.com's own
+   Dashboard/Rules pages, not the login page or `store.tcgplayer.com`.
+5. **Session import fails with "none of the pasted cookies are for
+   tcgplayer.com"** — the extension exported the wrong site's cookies;
+   make sure the active tab was massprice.tcgplayer.com when you clicked
+   Export.