remove xvfb, use headless with cookie auth

Dockerfile

@@ -7,13 +7,6 @@ RUN groupadd --system app && useradd --system --gid app --create-home app
 
 WORKDIR /app
 
-# Xvfb for headed Chromium in container (IAAI blocks headless)
-RUN apt-get update -qq && apt-get install -y --no-install-recommends xvfb \
-    && rm -rf /var/lib/apt/lists/*
-
-# Required for non-root Xvfb runtime in containers
-RUN mkdir -p /tmp/.X11-unix && chmod 1777 /tmp/.X11-unix
-
 COPY pyproject.toml uv.lock ./
 RUN pip install --no-cache-dir uv \
     && uv export --format requirements-txt --no-dev --no-hashes --no-emit-project --frozen -o /tmp/requirements.txt \