Replace credential auto-login with a Chrome-remote-debugging session capture flow

Live testing against the real site found MassPrice's login is behind
hCaptcha, which silently blocks fully automated username/password
login outright (the form never submits) — no selector fix could work
around this. Also fixed the broken _is_logged_out() heuristic: an
unauthenticated visit to /Rule/List redirects to the public marketing
homepage, not a /login URL, so run_rule/list_rules were silently
scraping the wrong page instead of erroring.

New flow: a Session page lets the user start a headless-but-CDP-exposed
Chromium instance, log in themselves via chrome://inspect (solving the
captcha as a real click), then capture that browser's cookies into the
same auth_state.json scheduled runs already use. Required a socat proxy
in the container image, since Chromium's debug port binds loopback-only
regardless of --remote-debugging-address (confirmed by live testing),
unreachable through Docker's port mapping without it. All Playwright
objects for this now live on one dedicated thread (automation.py's
_debug_worker), since the sync API isn't safe to call across the
arbitrary threads gunicorn's gthread workers hand out per request.

Dashboard now shows a banner when the latest run failed specifically
due to a missing/expired session, rather than just looking like an
empty rule list.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H6TgffxTvYhqxykAbVQg2v

docker-compose.yml

@@ -7,6 +7,16 @@ services:
     shm_size: "1gb"
     ports:
       - "${HOST_PORT:-5057}:5000"
+      # MassPrice's login is behind hCaptcha, which blocks fully
+      # automated sign-in — this port reaches (via an in-container socat
+      # proxy, see automation.py) headless Chromium's CDP debug endpoint,
+      # so a human can log in via chrome://inspect from their own machine
+      # (see the Session page / deploy-massprice skill). Maps to 9333,
+      # NOT Chromium's own 9222 — Chromium's debug port binds loopback-
+      # only regardless of config, so socat re-exposes it on a different
+      # internal port. Only listens while a login session is actively
+      # started from the webui, and only reachable on the LAN.
+      - "${DEBUG_PORT:-9222}:9333"
     volumes:
       # Schedules, run history, the rule-name cache, and the saved
       # MassPrice login session must outlive `up -d --build`, which
@@ -15,7 +25,6 @@ services:
     environment:
       - LOGIN_PASSWORD=${LOGIN_PASSWORD}
       - SECRET_KEY=${SECRET_KEY}
-      - MASSPRICE_USERNAME=${MASSPRICE_USERNAME}
-      - MASSPRICE_PASSWORD=${MASSPRICE_PASSWORD}
+      - DEBUG_PORT=${DEBUG_PORT:-9222}
       - TZ=${TZ:-America/New_York}
     restart: unless-stopped