Replace Chrome-remote-debugging login capture with a cookie-paste import flow

Live testing showed the CDP approach still fails hCaptcha even with a
real human clicking through chrome://inspect: the headless Chromium's
own fingerprint (HeadlessChrome user-agent, navigator.webdriver=true)
is what gets flagged, independent of who's driving it. Trying to
disguise that browser to get past bot detection would be captcha
evasion, not a session-handling technique, so that path is dropped
entirely rather than patched further.

New flow: log into MassPrice with an ordinary, non-automated browser
(hCaptcha passes normally), export the session's cookies with a
extension, and paste them into the Session page. import_cookies()
converts the export into Playwright's storage_state shape and verifies
it actually authenticates against the live site before saving it,
so a bad paste never clobbers a working session. This also removes the
now-unnecessary socat proxy / debug port exposure — Chromium's own
CDP port was only ever needed for the dropped approach.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H6TgffxTvYhqxykAbVQg2v

Dockerfile

@@ -5,13 +5,6 @@ LABEL maintainer="MassPrice Scheduler"
 
 WORKDIR /app
 
-# socat proxies the login-session debug port: Chromium's remote-debugging
-# port binds to 127.0.0.1 only, regardless of --remote-debugging-address
-# (deliberate Chromium security hardening, confirmed by testing) — a
-# loopback-only listener is unreachable through Docker's port mapping,
-# so socat re-exposes it on all interfaces. See automation.py.
-RUN apt-get update -qq && apt-get install -y -qq socat && rm -rf /var/lib/apt/lists/*
-
 COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt