fix: use curl_cffi Chrome TLS impersonation for Claude provider

claude.ai has the same Cloudflare TLS fingerprinting protection as
chatgpt.com. Apply the same fix: curl_cffi impersonate=chrome120,
remove base class User-Agent to avoid JA3/UA mismatch.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/providers/claude.py

@@ -3,25 +3,35 @@
 import logging
 import os
 
+from curl_cffi import requests as curl_requests
+
 from src.providers.base import BaseProvider, ProviderError
 
 logger = logging.getLogger(__name__)
 
 BASE_URL = "https://claude.ai/api"
+IMPERSONATE = "chrome120"
 
 
 class ClaudeProvider(BaseProvider):
     """Provider for Claude conversations via the internal web API.
 
-    Authentication: Cookie: sessionKey=<CLAUDE_SESSION_KEY>
-    Token: sessionKey cookie value from claude.ai.
-    Typical validity: ~30 days (opaque; expiry cannot be decoded client-side).
+    Uses curl_cffi to impersonate Chrome's TLS fingerprint, bypassing
+    Cloudflare's bot detection (same issue as chatgpt.com).
+
+    Authentication: sessionKey cookie (~30 day lifetime, opaque string).
+    Expiry cannot be decoded client-side — a 401 is the only signal.
     """
 
     provider_name = "claude"
 
     def __init__(self, session_key: str | None = None) -> None:
-        super().__init__()
+        cf_session = curl_requests.Session(impersonate=IMPERSONATE)
+        super().__init__(session=cf_session)  # type: ignore[arg-type]
+
+        # Remove base class User-Agent so curl_cffi uses its Chrome-matched UA
+        self._session.headers.pop("User-Agent", None)
+
         key = session_key or os.getenv("CLAUDE_SESSION_KEY", "").strip()
         if not key:
             raise ProviderError(
@@ -32,7 +42,7 @@ class ClaudeProvider(BaseProvider):
                     "Run 'python -m src.main auth' to configure it."
                 ),
             )
-        # Set sessionKey in the cookie jar (not as a raw header string)
+        # Set sessionKey in the cookie jar
         self._session.cookies.set("sessionKey", key, domain="claude.ai", path="/")
         self._session.headers.update(
             {
@@ -41,7 +51,7 @@ class ClaudeProvider(BaseProvider):
             }
         )
         self._org_id: str | None = None  # cached per session
-        logger.debug("[claude] Session initialised (key: [REDACTED])")
+        logger.debug("[claude] Session initialised with Chrome TLS impersonation (key: [REDACTED])")
 
     def _handle_401(self) -> None:
         msg = (