[Feature]: Sign-in window for cookie-only providers when App-Bound Encryption blocks browser import #988

Existing issues

• I searched existing issues and did not find a duplicate. Related: [Bug]: Brave automatic cookie import is blocked by App-Bound Encryption despite being documented as supported #455, [Bug]: Ollama Web/cookie source reports No cookies available despite a valid session #426, Import from Browser fails (codex) for both Chrome and Edge despite valid ChatGPT login #70.

Problem or use case

About 20 providers only sign in through a browser cookie (for example Perplexity, Manus, Ollama, Mistral, Notion, OpenCode, T3 Chat, Qwen). On Windows, Chrome and Edge store those cookies with App-Bound Encryption. As docs/COOKIES.md says, CodexBar does not bypass it, and we agree that it should not.

In practice that leaves Chrome or Edge users with two options: copy the Cookie header out of DevTools by hand, or sign in again in Firefox. Many users of our desk display (VibeTV, background in #640) cannot do the first and do not use Firefox. These providers then stay "signed out" with no way forward.

Proposed solution

A sign-in window owned by Win-CodexBar:

1. "Sign in" for a cookie provider opens a WebView2 window on the provider's login page, in a profile that belongs to CodexBar.
2. The user signs in normally, including 2FA or SSO.
3. CodexBar reads the session cookie for the provider's domain from its own WebView2 cookie store. That is not App-Bound, because CodexBar owns the profile. It saves the cookie as the provider's manual cookie (manual_cookies.json, DPAPI via secure_file) and closes the window.
4. Expiry works as today: when the site rejects the cookie, the provider reports signed out and the same window can be opened again.

For embedding apps, a CLI entry point that opens this window and returns when the cookie is saved or the user closes the window would be very useful, ideally under the same config login --provider <id> name as the CLI request for Copilot, Grok and Kiro (#987).

Affected area

• Settings UI
• CLI
• Provider-specific behavior
• Config file / settings persistence

Alternatives considered

• Bypassing App-Bound Encryption: rejected, same as your position in COOKIES.md.
• Manual cookie paste: works, but is too hard for most users.
• A sign-in window in our own app: we would rather not handle provider sessions outside CodexBar.

Additional context

This is a request, not a PR. We would like to know first whether you want this and in which shape (desktop only, or also from the CLI).