feat: auth capture — interactive browser, CDP header capture, cookie auth

- AuthCaptureDialog: full WS screenshot stream + mouse/keyboard/scroll events
- Backend auth_capture: CDP Network.requestWillBeSent for Authorization headers
- Candidate scoring: confidence 0-95%, preview (masked), auth_headers section
- Upstream form: add 'Cookie' auth type, handle cookie selection
- UpstreamClient: support auth_type=cookie with Cookie header
- No secrets logged at DEBUG or higher

backend/app/services/upstream_client.py

@@ -240,6 +240,10 @@ class UpstreamClient:
             header = self.auth_config.get("header", "Authorization")
             if key:
                 headers[header] = key
+        elif self.auth_type == "cookie":
+            cookie_str = self.auth_config.get("cookie_string", "")
+            if cookie_str:
+                headers["Cookie"] = cookie_str
         elif self.auth_type == "login_password" and self._token:
             headers["Authorization"] = f"Bearer {self._token}"
         if self.auth_type == "login_password" and self._new_api_user: