Replace Chrome-remote-debugging login capture with a cookie-paste import flow

Live testing showed the CDP approach still fails hCaptcha even with a
real human clicking through chrome://inspect: the headless Chromium's
own fingerprint (HeadlessChrome user-agent, navigator.webdriver=true)
is what gets flagged, independent of who's driving it. Trying to
disguise that browser to get past bot detection would be captcha
evasion, not a session-handling technique, so that path is dropped
entirely rather than patched further.

New flow: log into MassPrice with an ordinary, non-automated browser
(hCaptcha passes normally), export the session's cookies with a
extension, and paste them into the Session page. import_cookies()
converts the export into Playwright's storage_state shape and verifies
it actually authenticates against the live site before saving it,
so a bad paste never clobbers a working session. This also removes the
now-unnecessary socat proxy / debug port exposure — Chromium's own
CDP port was only ever needed for the dropped approach.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H6TgffxTvYhqxykAbVQg2v

app.py

@@ -8,7 +8,7 @@ import automation
 import scheduler
 import storage
 
-APP_VERSION = "0.2.0"
+APP_VERSION = "0.3.0"
 APP_VERSION_DATE = "2026-09-01"
 
 app = Flask(__name__)
@@ -111,30 +111,15 @@ def dashboard():
 @app.route("/session")
 @login_required
 def session_page():
-    return render_template(
-        "session.html",
-        status=automation.session_status(),
-        debug_active=automation.debug_session_active(),
-        debug_port=os.environ.get("DEBUG_PORT", "9222"),
-        host=request.host.split(":")[0],
-    )
+    return render_template("session.html", status=automation.session_status())
 
 
-@app.route("/api/session/start", methods=["POST"])
+@app.route("/api/session/import", methods=["POST"])
 @login_required
-def api_session_start():
+def api_session_import():
+    body = request.get_json(force=True, silent=True) or {}
     try:
-        automation.start_debug_session()
-    except Exception as exc:
-        return jsonify({"error": str(exc)}), 502
-    return jsonify({"ok": True})
-
-
-@app.route("/api/session/capture", methods=["POST"])
-@login_required
-def api_session_capture():
-    try:
-        automation.capture_debug_session()
+        automation.import_cookies(body.get("cookies", ""))
     except automation.AutomationError as exc:
         return jsonify({"error": str(exc)}), 409
     except Exception as exc:
@@ -142,13 +127,6 @@ def api_session_capture():
     return jsonify({"ok": True})
 
 
-@app.route("/api/session/stop", methods=["POST"])
-@login_required
-def api_session_stop():
-    automation.stop_debug_session()
-    return jsonify({"ok": True})
-
-
 @app.route("/activity")
 @login_required
 def activity():