feat: auth capture — interactive browser, CDP header capture, cookie auth

- AuthCaptureDialog: full WS screenshot stream + mouse/keyboard/scroll events
- Backend auth_capture: CDP Network.requestWillBeSent for Authorization headers
- Candidate scoring: confidence 0-95%, preview (masked), auth_headers section
- Upstream form: add 'Cookie' auth type, handle cookie selection
- UpstreamClient: support auth_type=cookie with Cookie header
- No secrets logged at DEBUG or higher

backend/app/routers/auth_capture.py

@@ -37,6 +37,7 @@ class CaptureExtractResponse(BaseModel):
     cookies: list[dict] = []
     storage: dict[str, str] = {}
     session_storage: dict[str, str] = {}
+    auth_headers: list[dict] = []
     candidates: list[dict] = []