fix: auto-clear a stale sign-in-wall pause on login/session recovery

[Multipixelone]

Problem

A reported "Costco login won't persist" turned out not to be a cookie/session bug. A transient Costco sign-in wall on 2026-07-06 latched worker_state.paused=1 with a reason string telling the operator to run roomieorder login — but nothing ever cleared that flag:

• cli login re-authenticated, printed "session persisted", and returned without touching the pause.
• main._session_check_tick only had a logged-out branch, so it could never un-pause.

Operator-visible loop: log in → "session persisted" → tap button → "Costco is logged out" again. The session was actually healthy (re-authing ~8×/day via the persistent kmsi/WC_PERSISTENT SSO chain); WC_AUTHENTICATION_<memberid> is a session cookie that is re-minted per launch by design, so a logged-out relaunch is expected and self-heals — only the stale pause flag kept ordering down.

Fix

Gated strictly to login/session pauses — captcha challenge, needs_review, worker crash, spend-cap and manual CLI pauses all stay operator-gated:

• store.py — LOGIN_PAUSE_MARKER + is_login_pause(reason, provider): single source of truth for classifying a sign-in-wall pause from the only thing a pause persists (its reason string). Provider-scoped so a signed-in Amazon probe can't clear a still-walled Costco pause.
• purchase.py — _signin_required builds its message from LOGIN_PAUSE_MARKER, so the reason it latches always carries the marker. Renders identically to the existing live string, so this also recovers an already-latched pause.
• main.py — _session_check_tick now logs every probe outcome (a healthy probe was previously silent) and, on a signed-in probe, clears a matching login pause (Engine._resume_if_login_pause) — self-heals a transient latch.
• cli.py — login resumes a matching login pause after a confirmed verify_session(), closing the log-in-but-still-paused loop; doctor now prints resolved absolute cwd/db/profile/catalog paths (and the per-profile absolute path) so a triage run from the repo checkout — whose CWD-relative config defaults read a different, empty DB — can't mistake a stale repo jar for the live service's.

Safety

Auto-resume can re-arm real ordering when DRY_RUN is off, hence the narrow gate. No DOM selectors touched, DRY_RUN untouched.

Tests

nix flake check equivalents pass locally: ruff clean, mypy clean (src + tests), 253 passed / 3 skipped. New coverage:

• classifier: recognises the sign-in reason (with/without provider), rejects challenge/needs-review/crash/spend-cap/manual/empty
• probe: resumes a Costco login pause when signed in; keeps a challenge pause latched; won't clear a Costco pause from a signed-in Amazon probe
• login: clears a matching sign-in pause; leaves a challenge pause latched

Follow-ups (deliberately not in this PR)

• nix/module.nix env-file quoting (would export DRY_RUN=false into repo shells unless paired with an .envrc guard).
• Re-deploy with nixos-rebuild switch so a reboot doesn't roll back to the older generation.