Replace credential auto-login with a Chrome-remote-debugging session capture flow

Live testing against the real site found MassPrice's login is behind
hCaptcha, which silently blocks fully automated username/password
login outright (the form never submits) — no selector fix could work
around this. Also fixed the broken _is_logged_out() heuristic: an
unauthenticated visit to /Rule/List redirects to the public marketing
homepage, not a /login URL, so run_rule/list_rules were silently
scraping the wrong page instead of erroring.

New flow: a Session page lets the user start a headless-but-CDP-exposed
Chromium instance, log in themselves via chrome://inspect (solving the
captcha as a real click), then capture that browser's cookies into the
same auth_state.json scheduled runs already use. Required a socat proxy
in the container image, since Chromium's debug port binds loopback-only
regardless of --remote-debugging-address (confirmed by live testing),
unreachable through Docker's port mapping without it. All Playwright
objects for this now live on one dedicated thread (automation.py's
_debug_worker), since the sync API isn't safe to call across the
arbitrary threads gunicorn's gthread workers hand out per request.

Dashboard now shows a banner when the latest run failed specifically
due to a missing/expired session, rather than just looking like an
empty rule list.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H6TgffxTvYhqxykAbVQg2v

app.py

@@ -8,8 +8,8 @@ import automation
 import scheduler
 import storage
 
-APP_VERSION = "0.1.0"
-APP_VERSION_DATE = "2026-08-31"
+APP_VERSION = "0.2.0"
+APP_VERSION_DATE = "2026-09-01"
 
 app = Flask(__name__)
 app.secret_key = os.environ.get("SECRET_KEY", "dev-secret-change-me")
@@ -81,6 +81,19 @@ def _merged_rules():
     return rules, cache.get("updated_at")
 
 
+def _session_warning():
+    """True if the most recent run/refresh failed specifically because
+    the saved MassPrice session is missing/expired — surfaced as a
+    dashboard banner so a dead session doesn't just look like "no rules"."""
+    history = storage.load("run_history.json", [])
+    if not history:
+        return False
+    latest = history[0]
+    return latest.get("status") == "failure" and "session expired or missing" in (
+        latest.get("message") or ""
+    )
+
+
 @app.route("/")
 @login_required
 def dashboard():
@@ -91,9 +104,51 @@ def dashboard():
         rules_updated_at=rules_updated_at,
         days=DAYS,
         day_labels=DAY_LABELS,
+        session_warning=_session_warning(),
     )
 
 
+@app.route("/session")
+@login_required
+def session_page():
+    return render_template(
+        "session.html",
+        status=automation.session_status(),
+        debug_active=automation.debug_session_active(),
+        debug_port=os.environ.get("DEBUG_PORT", "9222"),
+        host=request.host.split(":")[0],
+    )
+
+
+@app.route("/api/session/start", methods=["POST"])
+@login_required
+def api_session_start():
+    try:
+        automation.start_debug_session()
+    except Exception as exc:
+        return jsonify({"error": str(exc)}), 502
+    return jsonify({"ok": True})
+
+
+@app.route("/api/session/capture", methods=["POST"])
+@login_required
+def api_session_capture():
+    try:
+        automation.capture_debug_session()
+    except automation.AutomationError as exc:
+        return jsonify({"error": str(exc)}), 409
+    except Exception as exc:
+        return jsonify({"error": str(exc)}), 502
+    return jsonify({"ok": True})
+
+
+@app.route("/api/session/stop", methods=["POST"])
+@login_required
+def api_session_stop():
+    automation.stop_debug_session()
+    return jsonify({"ok": True})
+
+
 @app.route("/activity")
 @login_required
 def activity():