Takeover #108: Chrome import for HttpOnly cookie (needs live smoke test)

[nwparker]

Takeover of #108 (@sudhanshug16) — Chrome import fallback for the HttpOnly Slack d cookie. Rebased cleanly onto main, branch takeover/pr-108.

Addresses the Chrome side of #13.

Verified (offline)

• typecheck clean · 313 tests / 0 fail · lint 0 errors · format clean · build:npm + node --check OK
• Integration fix applied: main added test files mocking importChrome synchronously; made those mocks async (the PR makes importChrome async).
• The fallback reuses the same read-only SQLite helper + Chrome Safe Storage decrypt as the proven src/auth/brave.ts importer.

⚠️ Needs one live smoke test before merge

The crypto/cookie-DB fallback can't be exercised offline without a logged-in Chrome that has an HttpOnly d cookie. Please run agent-slack auth import-chrome once against a real HttpOnly Chrome session before merging (the original author reports doing this successfully). Everything else is green.

Made with Orca 🐋

[nwparker]

Note for the merge decision: on close inspection the fallback is a faithful port of the proven src/auth/brave.ts path — same SQL, same v10/v11 handling, same iterations: 1003, same keychain lookup — and it's actually slightly safer (snapshots the Cookies DB before querying; scans multiple profiles). So the live auth import-chrome check is closer to a smoke test than a risk gate. Still recommend running it once on a Chrome session with an HttpOnly d cookie before merging.