Replace credential auto-login with a Chrome-remote-debugging session capture flow

Live testing against the real site found MassPrice's login is behind
hCaptcha, which silently blocks fully automated username/password
login outright (the form never submits) — no selector fix could work
around this. Also fixed the broken _is_logged_out() heuristic: an
unauthenticated visit to /Rule/List redirects to the public marketing
homepage, not a /login URL, so run_rule/list_rules were silently
scraping the wrong page instead of erroring.

New flow: a Session page lets the user start a headless-but-CDP-exposed
Chromium instance, log in themselves via chrome://inspect (solving the
captcha as a real click), then capture that browser's cookies into the
same auth_state.json scheduled runs already use. Required a socat proxy
in the container image, since Chromium's debug port binds loopback-only
regardless of --remote-debugging-address (confirmed by live testing),
unreachable through Docker's port mapping without it. All Playwright
objects for this now live on one dedicated thread (automation.py's
_debug_worker), since the sync API isn't safe to call across the
arbitrary threads gunicorn's gthread workers hand out per request.

Dashboard now shows a banner when the latest run failed specifically
due to a missing/expired session, rather than just looking like an
empty rule list.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H6TgffxTvYhqxykAbVQg2v

.env.example

@@ -10,17 +10,16 @@ LOGIN_PASSWORD=changeme
 #   python3 -c "import secrets; print(secrets.token_hex(32))"
 SECRET_KEY=change_this_to_a_random_secret_key
 
-# ── MassPrice (TCGplayer) login ─────────────────────────────────────
-# Used by Playwright to log in automatically the first time, and again
-# any time the saved session expires. Stored here only — gitignored,
-# never committed, never logged.
-MASSPRICE_USERNAME=your_tcgplayer_email@example.com
-MASSPRICE_PASSWORD=your_tcgplayer_password
-
 # ── Host port (what port Unraid exposes) ────────────────────────────
 # Default is 5057 (arr-summary already uses 5056) — change if in use
 HOST_PORT=5057
 
+# ── Debug port (Chrome remote debugging, for logging in) ───────────
+# MassPrice's login is behind hCaptcha, so there's no way to fully
+# automate signing in. Log in via the webui's Session page instead,
+# which connects your own Chrome (chrome://inspect) to this port.
+DEBUG_PORT=9222
+
 # ── Timezone ─────────────────────────────────────────────────────────
 # Controls what "6:00 AM" means for your schedules
 TZ=America/New_York