Read the session from a signed-in Firefox-family browser

[curbol]

What

Adds a third session source: a signed-in Firefox-family browser. session_source = "browser"
(or --session browser) reads Gecko's session store instead of a pasted curl command.

--session also now accepts a browser profile directory or a recovery.jsonlz4 directly, and
works out what any path is by reading it rather than by configuration — a session store is
identified by its mozLz40\0 magic, a curl paste by its structure.

Why

The paste exists because LS is a session cookie and cookies.sqlite never holds it. That
measurement was right and the conclusion drawn from it was wrong: Gecko keeps a session
store so it can restore a session, and that file holds the cookies of every host the session
touched — LS among them. Verified against a real profile: LS + _csrf out of
recovery.jsonlz4 return HTTP 200 with the full owned list.

Two properties decide what this can promise, both measured rather than assumed:

• Not tab-scoped. On the profile tested, 156 of 169 cookie hosts had no tab open anywhere
  in the session, assetstore.unity.com among them. The credential outlives the tab and lasts
  as long as the browsing session, so this is not "keep a tab open".
• It lags. The file is rewritten periodically, not on every cookie change, so a sign-in
  takes seconds to show up.

Chromium keeps session cookies in an encrypted SQLite database instead, so it is out of scope
and the docs say so.

Notable details

• Profile discovery reads installs.ini before the Default=1 flag in profiles.ini.
  They disagree on the machine this was built against, and only the profile installs.ini
  names has a session store at all. Preferring the flag finds an empty profile and reports no
  session on a machine where there plainly is one.
• The mozlz4 decoder is ~40 lines rather than a dependency, in a module that otherwise has
  one. It is bounds-checked throughout because it parses a file another program wrote, and it
  caps the size the header claims so a corrupt header cannot become a huge allocation.
• The session store is read narrowly. It carries credentials for every host the browsing
  session touched, so it is filtered to the unity.com family inside internal/session
  before anything leaves the package, and no cookie value is ever logged — every error and
  diagnostic carries paths and cookie names only.

Testing

go test -race ./... green across 14 packages; go vet and gofmt -l clean.

New tests cover the decoder against overlapping matches, extended match lengths, truncated
blocks, a header that overstates its payload, and one that claims a gigabyte; that only
unity.com cookies survive a jar containing other sites; that installs.ini beats the
Default=1 flag; that a profile without the credential is skipped rather than fatal; and that
a path is identified by content.

One test is opt-in and skipped by default, since it needs a live credential store:

UNITY_SYNC_REAL_SESSIONSTORE=~/.config/zen/<profile>/sessionstore-backups/recovery.jsonlz4 \
  go test ./internal/session/

Run live against the real 176-asset account, all three paths:

• session_source = "browser" in config.toml — no paste anywhere, reports which profile it read
• --session <profile dir> pointed straight at a Zen profile
• --session session.curl, the existing paste, unchanged

Release Notes

You can now point unity-sync at your browser instead of pasting a session. Set
session_source = "browser" in config.toml, sign in to the Asset Store in Firefox, Zen,
LibreWolf, Waterfox or Floorp, and unity-sync reads the session from there — no re-pasting when
it expires. Pasting still works exactly as before.