Replace Chrome-remote-debugging login capture with a cookie-paste import flow

Live testing showed the CDP approach still fails hCaptcha even with a
real human clicking through chrome://inspect: the headless Chromium's
own fingerprint (HeadlessChrome user-agent, navigator.webdriver=true)
is what gets flagged, independent of who's driving it. Trying to
disguise that browser to get past bot detection would be captcha
evasion, not a session-handling technique, so that path is dropped
entirely rather than patched further.

New flow: log into MassPrice with an ordinary, non-automated browser
(hCaptcha passes normally), export the session's cookies with a
extension, and paste them into the Session page. import_cookies()
converts the export into Playwright's storage_state shape and verifies
it actually authenticates against the live site before saving it,
so a bad paste never clobbers a working session. This also removes the
now-unnecessary socat proxy / debug port exposure — Chromium's own
CDP port was only ever needed for the dropped approach.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H6TgffxTvYhqxykAbVQg2v

templates/session.html

@@ -7,40 +7,37 @@
   <h2>Status</h2>
   {% if status.state == 'saved' %}
     <p><span class="status-dot status-success"></span>Session saved {{ status.saved_at }}</p>
-    <p class="muted small">If scheduled runs start failing with a "session expired" error, come back here and log in again.</p>
+    <p class="muted small">If scheduled runs start failing with a "session expired" error, come back here and import a fresh export.</p>
   {% else %}
-    <p><span class="status-dot status-failure"></span>No session saved yet &mdash; scheduled runs will fail until you log in.</p>
+    <p><span class="status-dot status-failure"></span>No session saved yet &mdash; scheduled runs will fail until you import one.</p>
   {% endif %}
 </div>
 
 <div class="panel panel-narrow">
   <h2>Log in</h2>
   <p class="muted small">
-    MassPrice's login is protected by hCaptcha, which blocks fully automated
-    sign-in. You need to log in yourself, at least once per session lifetime,
-    using your own Chrome browser connected to a debug browser running in
-    this container.
+    MassPrice's login is protected by hCaptcha, which blocks any automated
+    sign-in attempt &mdash; including a real click relayed through a headless
+    browser, since the browser itself gets flagged. There's no way around
+    this: log in with your own ordinary Chrome instead, then copy that
+    session over.
   </p>
   <ol class="session-steps">
-    <li>Click <strong>Start Login Session</strong> below.</li>
-    <li>On your own computer, open Chrome and go to <code>chrome://inspect/#devices</code>.</li>
-    <li>Under "Discover network targets", click <strong>Configure&hellip;</strong> and add
-      <code>{{ host }}:{{ debug_port }}</code>, then close the dialog.</li>
-    <li>A MassPrice tab should appear under "Remote Target" &mdash; click
-      <strong>inspect</strong> to open it, then log in normally (including solving the
-      hCaptcha challenge yourself).</li>
-    <li>Once you're looking at the MassPrice dashboard or rules list in that inspected
-      tab, come back here and click <strong>Capture Session</strong>.</li>
+    <li>Log into <a href="https://massprice.tcgplayer.com/" target="_blank" rel="noopener">massprice.tcgplayer.com</a>
+      normally, in your own Chrome.</li>
+    <li>Install the <strong>Cookie-Editor</strong> extension (free, from the
+      Chrome Web Store) if you don't already have it.</li>
+    <li>While still on the massprice.tcgplayer.com tab (not the login page),
+      click the Cookie-Editor icon, then <strong>Export</strong> &rarr;
+      <strong>Export as JSON</strong> &mdash; this copies the cookies to your
+      clipboard.</li>
+    <li>Paste them into the box below and click <strong>Import Session</strong>.</li>
   </ol>
 
+  <textarea id="cookie-paste" class="cookie-textarea" placeholder='[{"domain": ".tcgplayer.com", "name": "...", ...}]' rows="8"></textarea>
   <div class="session-actions">
-    <button id="session-start" type="button" class="btn btn-primary" {{ 'disabled' if debug_active else '' }}>Start Login Session</button>
-    <button id="session-capture" type="button" class="btn" {{ 'disabled' if not debug_active else '' }}>Capture Session</button>
-    <button id="session-stop" type="button" class="btn" {{ 'disabled' if not debug_active else '' }}>Stop</button>
+    <button id="session-import" type="button" class="btn btn-primary">Import Session</button>
   </div>
-  {% if debug_active %}
-  <p class="muted small">Login session is active &mdash; it auto-closes after 10 minutes if not captured.</p>
-  {% endif %}
 </div>
 {% endblock %}
 {% block scripts %}