Replace Chrome-remote-debugging login capture with a cookie-paste import flow

Live testing showed the CDP approach still fails hCaptcha even with a
real human clicking through chrome://inspect: the headless Chromium's
own fingerprint (HeadlessChrome user-agent, navigator.webdriver=true)
is what gets flagged, independent of who's driving it. Trying to
disguise that browser to get past bot detection would be captcha
evasion, not a session-handling technique, so that path is dropped
entirely rather than patched further.

New flow: log into MassPrice with an ordinary, non-automated browser
(hCaptcha passes normally), export the session's cookies with a
extension, and paste them into the Session page. import_cookies()
converts the export into Playwright's storage_state shape and verifies
it actually authenticates against the live site before saving it,
so a bad paste never clobbers a working session. This also removes the
now-unnecessary socat proxy / debug port exposure — Chromium's own
CDP port was only ever needed for the dropped approach.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H6TgffxTvYhqxykAbVQg2v

.env.example

@@ -14,12 +14,6 @@ SECRET_KEY=change_this_to_a_random_secret_key
 # Default is 5057 (arr-summary already uses 5056) — change if in use
 HOST_PORT=5057
 
-# ── Debug port (Chrome remote debugging, for logging in) ───────────
-# MassPrice's login is behind hCaptcha, so there's no way to fully
-# automate signing in. Log in via the webui's Session page instead,
-# which connects your own Chrome (chrome://inspect) to this port.
-DEBUG_PORT=9222
-
 # ── Timezone ─────────────────────────────────────────────────────────
 # Controls what "6:00 AM" means for your schedules
 TZ=America/New_York