Remove auth --from-browser browser cookie extraction

Browser cookie auto-extraction is not viable: modern Chromium App-Bound
Encryption (Chrome 127+/current Brave) keys cookies off a SYSTEM-level
layer that cannot be decrypted off disk without admin rights and AV-flagged
SYSTEM impersonation, and fails on Brave specifically. Drop the
`--from-browser` flag, `_auth_from_browser`, `src/browser_tokens.py`, its
test, and the browser-cookie3 dependency. Auth is manual (DevTools wizard)
only.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -87,23 +87,22 @@ This checks token presence, format, expiry, directory permissions, disk space, a
 
 Session tokens are how your browser stays logged in. This tool uses them to access your chat history on your behalf.
 
-### The fast way: extract from your browser
-
-If the browser you're logged in with runs on the same machine as this tool:
+Tokens are entered manually — copy them from your browser's DevTools and run the wizard:
 
 ```bash
-ai-chat-exporter auth --from-browser            # Brave (default)
-ai-chat-exporter auth --from-browser firefox    # or chrome, chromium, edge
+ai-chat-exporter auth
 ```
 
-This reads the session cookies straight from the browser's cookie store (decrypted via the OS keyring/DPAPI/Keychain), validates each token against the live API, and writes `.env` — no DevTools, no copy-pasting. A token that fails validation never overwrites a working one. If extraction fails (browser not installed here, cookie DB locked, logged out), fall back to the manual flow below.
+The wizard detects your OS, shows the correct DevTools shortcut, and writes the values to `.env` without echoing them to the terminal.
+
+> **Why no auto-extraction from the browser?** Modern Chromium browsers (Chrome 127+, current Brave) encrypt cookies on Windows with **App-Bound Encryption**: the key is bound to the browser through a SYSTEM-level service, so reading cookies off disk requires Administrator rights and a PsExec-style SYSTEM impersonation that antivirus flags as credential theft — and it still fails on Brave specifically. There is no reliable, non-invasive way to pull these cookies automatically, so the manual DevTools flow below is the supported path.
 
 ### Token Lifetimes
 
 | Provider | Cookie Name | Lifetime | Expiry Detection |
 |----------|-------------|----------|-----------------|
-| ChatGPT | `__Secure-next-auth.session-token.0` + `.1` | ~7 days | JWT `exp` claim (decoded automatically) |
-| Claude | `sessionKey` | ~30 days | Only detectable via 401 response |
+| ChatGPT | `__Secure-next-auth.session-token.0` + `.1` | refresh ~weekly | `error` field of `/api/auth/session` — `doctor` reports "ChatGPT token active". The token is an encrypted JWE, so its `exp` is **not** readable client-side, and the `expires` field is a misleading rolling window; the `error` (`RefreshAccessTokenError` when dead) is the honest signal. |
+| Claude | `sessionKey` | ~30 days | Opaque token — only detectable via 401 response |
 
 ### Finding Tokens in Chrome DevTools
 
@@ -285,10 +284,9 @@ Each provider+project combination maps to a flat Joplin notebook created automat
 
 ```bash
 ai-chat-exporter auth                  # manual wizard (DevTools flow)
-ai-chat-exporter auth --from-browser   # extract from Brave's cookie store
 ```
 
-Guided wizard to find and save session tokens and ChatGPT project IDs. Detects OS and shows the correct DevTools shortcut. `--from-browser [brave|chrome|chromium|edge|firefox]` skips the wizard and pulls tokens directly from a local browser, validating them live before writing `.env`.
+Guided wizard to find and save session tokens and ChatGPT project IDs. Detects OS and shows the correct DevTools shortcut, then writes the values to `.env`.
 
 ### `doctor` — Health check