Replace credential auto-login with a Chrome-remote-debugging session capture flow

Live testing against the real site found MassPrice's login is behind
hCaptcha, which silently blocks fully automated username/password
login outright (the form never submits) — no selector fix could work
around this. Also fixed the broken _is_logged_out() heuristic: an
unauthenticated visit to /Rule/List redirects to the public marketing
homepage, not a /login URL, so run_rule/list_rules were silently
scraping the wrong page instead of erroring.

New flow: a Session page lets the user start a headless-but-CDP-exposed
Chromium instance, log in themselves via chrome://inspect (solving the
captcha as a real click), then capture that browser's cookies into the
same auth_state.json scheduled runs already use. Required a socat proxy
in the container image, since Chromium's debug port binds loopback-only
regardless of --remote-debugging-address (confirmed by live testing),
unreachable through Docker's port mapping without it. All Playwright
objects for this now live on one dedicated thread (automation.py's
_debug_worker), since the sync API isn't safe to call across the
arbitrary threads gunicorn's gthread workers hand out per request.

Dashboard now shows a banner when the latest run failed specifically
due to a missing/expired session, rather than just looking like an
empty rule list.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H6TgffxTvYhqxykAbVQg2v

templates/session.html

@@ -0,0 +1,48 @@
+{% extends "_shell.html" %}
+{% block title %}Session · MassPrice Scheduler{% endblock %}
+{% block content %}
+<h1>MassPrice Login Session</h1>
+
+<div class="panel panel-narrow">
+  <h2>Status</h2>
+  {% if status.state == 'saved' %}
+    <p><span class="status-dot status-success"></span>Session saved {{ status.saved_at }}</p>
+    <p class="muted small">If scheduled runs start failing with a "session expired" error, come back here and log in again.</p>
+  {% else %}
+    <p><span class="status-dot status-failure"></span>No session saved yet &mdash; scheduled runs will fail until you log in.</p>
+  {% endif %}
+</div>
+
+<div class="panel panel-narrow">
+  <h2>Log in</h2>
+  <p class="muted small">
+    MassPrice's login is protected by hCaptcha, which blocks fully automated
+    sign-in. You need to log in yourself, at least once per session lifetime,
+    using your own Chrome browser connected to a debug browser running in
+    this container.
+  </p>
+  <ol class="session-steps">
+    <li>Click <strong>Start Login Session</strong> below.</li>
+    <li>On your own computer, open Chrome and go to <code>chrome://inspect/#devices</code>.</li>
+    <li>Under "Discover network targets", click <strong>Configure&hellip;</strong> and add
+      <code>{{ host }}:{{ debug_port }}</code>, then close the dialog.</li>
+    <li>A MassPrice tab should appear under "Remote Target" &mdash; click
+      <strong>inspect</strong> to open it, then log in normally (including solving the
+      hCaptcha challenge yourself).</li>
+    <li>Once you're looking at the MassPrice dashboard or rules list in that inspected
+      tab, come back here and click <strong>Capture Session</strong>.</li>
+  </ol>
+
+  <div class="session-actions">
+    <button id="session-start" type="button" class="btn btn-primary" {{ 'disabled' if debug_active else '' }}>Start Login Session</button>
+    <button id="session-capture" type="button" class="btn" {{ 'disabled' if not debug_active else '' }}>Capture Session</button>
+    <button id="session-stop" type="button" class="btn" {{ 'disabled' if not debug_active else '' }}>Stop</button>
+  </div>
+  {% if debug_active %}
+  <p class="muted small">Login session is active &mdash; it auto-closes after 10 minutes if not captured.</p>
+  {% endif %}
+</div>
+{% endblock %}
+{% block scripts %}
+<script src="{{ url_for('static', filename='js/app.js') }}"></script>
+{% endblock %}