Replace credential auto-login with a Chrome-remote-debugging session capture flow

Live testing against the real site found MassPrice's login is behind
hCaptcha, which silently blocks fully automated username/password
login outright (the form never submits) — no selector fix could work
around this. Also fixed the broken _is_logged_out() heuristic: an
unauthenticated visit to /Rule/List redirects to the public marketing
homepage, not a /login URL, so run_rule/list_rules were silently
scraping the wrong page instead of erroring.

New flow: a Session page lets the user start a headless-but-CDP-exposed
Chromium instance, log in themselves via chrome://inspect (solving the
captcha as a real click), then capture that browser's cookies into the
same auth_state.json scheduled runs already use. Required a socat proxy
in the container image, since Chromium's debug port binds loopback-only
regardless of --remote-debugging-address (confirmed by live testing),
unreachable through Docker's port mapping without it. All Playwright
objects for this now live on one dedicated thread (automation.py's
_debug_worker), since the sync API isn't safe to call across the
arbitrary threads gunicorn's gthread workers hand out per request.

Dashboard now shows a banner when the latest run failed specifically
due to a missing/expired session, rather than just looking like an
empty rule list.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H6TgffxTvYhqxykAbVQg2v

.claude/skills/deploy-massprice/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: deploy-massprice
-description: Use when deploying MassPrice Scheduler, restarting the massprice container on Unraid, confirming a deploy landed, or troubleshooting its scheduled-rule automation.
+description: Use when deploying MassPrice Scheduler, restarting the massprice container on Unraid, confirming a deploy landed, logging into MassPrice via the Session page, or troubleshooting its scheduled-rule automation.
 ---
 
 ## Deployment
@@ -9,15 +9,14 @@ description: Use when deploying MassPrice Scheduler, restarting the massprice co
 built from `Dockerfile`/`docker-compose.yml` in this repo. Container name
 `massprice`, port `5057` (overridable via `HOST_PORT` — `5056` was
 already taken by `arr-summary`, despite its own docs saying `5055`) →
-container port
-`5000`.
+container port `5000`. Also exposes `DEBUG_PORT` (default `9222`) for the
+Chrome-remote-debugging login flow — see below.
 
 **Deploy mechanism: Forgejo push-to-deploy**, the same pattern as
 `arr-summary`, `card-grader`, `lunch-notifier`, `n64-tracker` — see
 `arr-summary`'s `deploy-arr-summary` skill or `card-grader`'s `CLAUDE.md`
 for the full runner mechanics. Push to `main` on the `forgejo` remote
-(`https://git.hippofam.com/ninja_hippo/massprice.git` — create this repo
-on the Forgejo instance first if it doesn't exist yet) triggers
+(`https://git.hippofam.com/ninja_hippo/massprice.git`) triggers
 `.forgejo/workflows/deploy.yml`, which syncs into
 `/mnt/user/appdata/massprice` (excluding `.git`, `.env`, `data/`) and
 runs `docker compose up -d --build`.
@@ -40,41 +39,41 @@ cd /mnt/user/appdata/massprice && docker compose restart
 
 1. Create `/mnt/user/appdata/massprice` on Unraid and a real `.env`
    there (copy `.env.example`, fill in `LOGIN_PASSWORD`, `SECRET_KEY`,
-   `MASSPRICE_USERNAME`, `MASSPRICE_PASSWORD`, `TZ`).
+   `HOST_PORT`, `DEBUG_PORT`, `TZ`).
 2. First `docker compose up -d --build` — confirm the container starts
    and `/login` responds on `HOST_PORT`.
-3. Log into the webui, click "Refresh Rules" — confirms Playwright can
-   reach massprice.tcgplayer.com and log in automatically. **If this
-   fails**, check `data/run_history.json`/container logs for the login
-   error — the login form locators in `automation._login()` were written
-   generically (never verified against the real logged-out form, see
-   `CLAUDE.md`) and may need adjusting to match TCGplayer's actual field
-   names/labels.
-4. Set up at least one schedule and use "Run Now" once to confirm a
+3. Log into the webui, go to the **Session** page, and follow its
+   instructions: click "Start Login Session", connect your own Chrome to
+   `<unraid-ip>:<DEBUG_PORT>` via `chrome://inspect`, log in (solving the
+   hCaptcha yourself — this cannot be automated, see `CLAUDE.md`), then
+   click "Capture Session" back in the webui.
+4. Click "Refresh Rules" on the Dashboard — confirms the saved session
+   actually works and pulls the real rule list.
+5. Set up at least one schedule and use "Run Now" once to confirm a
    click actually lands — cross-check by looking at MassPrice's own
    Activity Log (`https://massprice.tcgplayer.com/Activity/List`) for a
    fresh timestamp on that rule.
-5. **Only after step 4 succeeds**, go to each of the 5 existing rules on
+6. **Only after step 5 succeeds**, go to each existing rule on
    massprice.tcgplayer.com (three-dot menu → Edit Schedule) and set
    Status to Inactive, so native scheduling stops double-triggering runs
    and this tool becomes the sole source of scheduled runs.
 
 ## Persistent state, never touched by deploys
 
-`.env` holds `LOGIN_PASSWORD`, `SECRET_KEY`, and the MassPrice
-credentials. `data/` (bind-mounted to `/data`) holds `schedules.json`
-(the schedules set from the webui), `auth_state.json` (the saved
-MassPrice browser session — losing this just costs one re-login, not
-data), `run_history.json`, and `rules_cache.json`. Both are excluded
-from the deploy rsync (which runs `--delete`) and from git.
+`.env` holds `LOGIN_PASSWORD` and `SECRET_KEY`. `data/` (bind-mounted to
+`/data`) holds `schedules.json` (the schedules set from the webui),
+`auth_state.json` (the saved MassPrice browser session captured via the
+Session page — losing this just costs one re-login, not data),
+`run_history.json`, and `rules_cache.json`. Both are excluded from the
+deploy rsync (which runs `--delete`) and from git.
 
 ## If scheduled runs stop working
 
 Check, in order:
-1. **Activity page in the webui** — does the failure message say
-   "still on a login page" (credentials/CAPTCHA problem) or "rule id not
-   found" (a rule was renamed/deleted on MassPrice — click "Refresh
-   Rules")?
+1. **Dashboard banner / Activity page** — a "session expired or missing"
+   message means go log in again via the Session page. "rule id not
+   found" means a rule was renamed/deleted on MassPrice — click "Refresh
+   Rules".
 2. **Is the container still running** — `docker ps --filter
    name=massprice` — a Chromium crash inside the container (rare, but
    possible if `shm_size` ever gets dropped from `docker-compose.yml`)
@@ -82,3 +81,8 @@ Check, in order:
 3. **Timezone** — `TZ` in `.env` controls what "6:00 AM" means for every
    schedule; confirm it matches what the user actually expects before
    assuming a schedule itself is wrong.
+4. **Session capture stuck at "Still not logged in"** — the debug
+   session's page needs to actually be on `/Rule/List` or somewhere under
+   `/Rule` after login for the capture check to pass; if the inspected
+   tab is still sitting on the marketing homepage or the OAuth login
+   page, finish clicking through to the dashboard/rules first.