chrome-service: switch to CDP + persistent profile + hourly snapshot pipeline

The chrome-service stack ran `playwright launch-server`, which creates
ephemeral browser contexts per `connect()`. Despite the encrypted PVC
mounted at /profile, no chromium user-data ever persisted — only npm
cache + fontconfig. Logging in via noVNC was effectively a no-op.

Refactor:
- Replace launch-server with direct chromium (TCP CDP on :9223 internal),
  fronted by a Python HTTP+WS bridge on :9222 that rewrites the Host
  header to bypass Chrome's hardcoded DNS-rebinding protection (no
  `--remote-allow-hosts` flag exists in stock Chrome 130; verified by
  binary string grep). Bridge also forces Connection: close on HTTP
  responses so Node ws opens a fresh TCP for the WS upgrade rather than
  trying to reuse the dead keep-alive socket.
- Add `--user-data-dir=/profile/chromium-data` so cookies/localStorage
  actually persist on the encrypted PVC.
- New snapshot-server sidecar (stdlib python HTTP) serves
  GET /api/snapshot at chrome.viktorbarzin.me/api/snapshot,
  bearer-token-gated by the existing api_bearer_token.
- New chrome-service-snapshot-harvester CronJob (hourly) connects via
  CDP, dumps storage_state() (cookies + localStorage), writes atomically
  to /profile/snapshots/storage-state.json.
- NetworkPolicy: TCP/9222 (was :3000), TCP/8088 added for traefik.

Caller migration:
- f1-stream: `chromium.connect(ws_url)` → `chromium.connect_over_cdp(cdp_url)`,
  env var CHROME_WS_URL → CHROME_CDP_URL. CHROME_WS_TOKEN dropped (no
  longer used by code; ExternalSecret kept for symmetry with the snapshot
  endpoint).

Dev-box side (out of scope for this commit — see ~/.config/systemd/user/):
- playwright-mcp.service flips to `--isolated --storage-state=...`
  so per-Claude-Code-session ephemeral contexts seed from the snapshot.
- playwright-snapshot-refresh.{service,timer} (hourly) pulls the
  snapshot via the bearer-gated HTTPS endpoint.

Docs updated:
- docs/architecture/chrome-service.md — new architecture diagram + wire protocol.
- docs/runbooks/chrome-service-snapshot.md — day-2 ops (refresh, rotation,
  failure modes, restore).
- stacks/chrome-service/README.md — connect_over_cdp recipe.

Design spec at docs/superpowers/specs/2026-06-04-playwright-per-session-browser-design.md.

stacks/f1-stream/files/backend/extractors/chrome_browser.py

@@ -86,12 +86,16 @@ def _looks_like_hls_playlist(url: str) -> bool:
     return bool(_HLS_URL_RE.search(url))
 
 
-def _resolve_chrome_ws() -> str | None:
-    base = os.getenv("CHROME_WS_URL")
-    token = os.getenv("CHROME_WS_TOKEN")
-    if not base or not token:
-        return None
-    return f"{base.rstrip('/')}/{token}"
+def _resolve_chrome_cdp() -> str | None:
+    """Resolve the CHROME_CDP_URL env var (set by f1-stream's TF stack).
+
+    Migrated 2026-06-04 from CHROME_WS_URL/CHROME_WS_TOKEN. chrome-service
+    now runs chromium directly with CDP exposed on :9222 so its persistent
+    user-data-dir actually persists cookies (the old playwright launch-server
+    pattern created ephemeral contexts per `connect()`). NetworkPolicy
+    (labelled client namespaces only) is the only gate — no path token.
+    """
+    return os.getenv("CHROME_CDP_URL")
 
 
 class ChromeBrowserExtractor(BaseExtractor):
@@ -106,10 +110,10 @@ class ChromeBrowserExtractor(BaseExtractor):
         return "Chrome Browser"
 
     async def extract(self) -> list[ExtractedStream]:
-        ws_url = _resolve_chrome_ws()
-        if not ws_url:
+        cdp_url = _resolve_chrome_cdp()
+        if not cdp_url:
             logger.warning(
-                "[chrome-browser] CHROME_WS_URL/TOKEN not set — extractor disabled"
+                "[chrome-browser] CHROME_CDP_URL not set — extractor disabled"
             )
             return []
 
@@ -123,9 +127,9 @@ class ChromeBrowserExtractor(BaseExtractor):
         # round. Contexts are cheap; the browser is shared.
         async with async_playwright() as p:
             try:
-                browser = await p.chromium.connect(ws_url, timeout=15_000)
+                browser = await p.chromium.connect_over_cdp(cdp_url, timeout=15_000)
             except Exception:
-                logger.exception("[chrome-browser] connect to chrome-service failed")
+                logger.exception("[chrome-browser] CDP connect to chrome-service failed")
                 return []
 
             results: list[ExtractedStream] = []