feat: auth-capture — WS frame stream, drag events, continuous CDP, profile cleanup

- AuthCaptureDialog: real WebSocket for binary JPEG frame stream (no polling)
- Pointer drag: mousedown/mousemove/mouseup events for slider-captcha
- CDP capture starts at session creation, caches headers in session.captured_headers
- Ephemeral profile dir deleted on session close (shutil.rmtree)
- Candidate types unified: bearer_token / cookie / api_key / credential
- Frontend handleAuthCaptureSelect maps all 4 types to correct form fields

frontend/src/api/index.ts

@@ -339,7 +339,7 @@ export interface AuthCaptureResult {
   session_storage: Record<string, string>
   auth_headers: Record<string, string>[]
   candidates: {
-    type: 'bearer_token' | 'cookie' | 'credential'
+    type: 'bearer_token' | 'cookie' | 'credential' | 'api_key'
     source: string
     value: string
     preview: string