Replace credential auto-login with a Chrome-remote-debugging session capture flow

Live testing against the real site found MassPrice's login is behind
hCaptcha, which silently blocks fully automated username/password
login outright (the form never submits) — no selector fix could work
around this. Also fixed the broken _is_logged_out() heuristic: an
unauthenticated visit to /Rule/List redirects to the public marketing
homepage, not a /login URL, so run_rule/list_rules were silently
scraping the wrong page instead of erroring.

New flow: a Session page lets the user start a headless-but-CDP-exposed
Chromium instance, log in themselves via chrome://inspect (solving the
captcha as a real click), then capture that browser's cookies into the
same auth_state.json scheduled runs already use. Required a socat proxy
in the container image, since Chromium's debug port binds loopback-only
regardless of --remote-debugging-address (confirmed by live testing),
unreachable through Docker's port mapping without it. All Playwright
objects for this now live on one dedicated thread (automation.py's
_debug_worker), since the sync API isn't safe to call across the
arbitrary threads gunicorn's gthread workers hand out per request.

Dashboard now shows a banner when the latest run failed specifically
due to a missing/expired session, rather than just looking like an
empty rule list.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H6TgffxTvYhqxykAbVQg2v

static/js/app.js

@@ -21,8 +21,40 @@ document.addEventListener("DOMContentLoaded", () => {
   }
 
   document.querySelectorAll(".rule-card").forEach(initRuleCard);
+  initSessionControls();
 });
 
+function initSessionControls() {
+  const startBtn = document.getElementById("session-start");
+  const captureBtn = document.getElementById("session-capture");
+  const stopBtn = document.getElementById("session-stop");
+  if (!startBtn) return; // not on the Session page
+
+  async function call(url, btn) {
+    btn.disabled = true;
+    const original = btn.textContent;
+    btn.textContent = "Working…";
+    try {
+      const res = await fetch(url, { method: "POST" });
+      const data = await res.json().catch(() => ({}));
+      if (!res.ok) {
+        alert(data.error || "Request failed");
+        btn.disabled = false;
+        btn.textContent = original;
+        return;
+      }
+      window.location.reload();
+    } catch (err) {
+      btn.disabled = false;
+      btn.textContent = original;
+    }
+  }
+
+  startBtn.addEventListener("click", () => call("/api/session/start", startBtn));
+  captureBtn.addEventListener("click", () => call("/api/session/capture", captureBtn));
+  stopBtn.addEventListener("click", () => call("/api/session/stop", stopBtn));
+}
+
 function initRuleCard(card) {
   const ruleId = card.dataset.ruleId;