fix(gui,cli,core): offer the CAPTCHA in the browser when the web view cannot start (B195)

The verification window now runs in its own process, so the app survives
when WebKit cannot start its sandbox on secureblue, but the CAPTCHA still
could not be solved there (#29). WebKit binds the journal socket with
`--ro-bind-try`, bubblewrap only skips a missing path, not an unreadable
one, and WebKit has no switch to leave the socket out.

Proton Mail Bridge never uses a web view: it opens verify.proton.me in the
system browser and retries with the original challenge token, typed with
the offered methods. Do the same as a fallback.

- core: `browser_verification_url` and `browser_verified` build the page
  URL and the retry credential from the challenge
- gui: when the verification window fails, a dialog opens the page in the
  browser and continues the sign-in once the user is done
- cli: `pdfs login` handles a CAPTCHA the same way instead of failing
- i18n: translate the new dialog in every catalog
- docs: B195, TROUBLESHOOTING.md, ARCHITECTURE.md, changelog

Fixes #29

crates/pdfs-cli/src/main.rs

@@ -1816,20 +1816,29 @@ fn cmd_login(username: Option<String>, remember: bool) -> Result<()> {
     // Only a two-password account is ever asked for this.
     let get_mailbox = |attempt: u32| prompt_mailbox(attempt, remember);
 
+    // Proton may ask for a CAPTCHA first, usually on a VPN. The CLI has no
+    // browser engine, so the user solves the page in their own browser and says
+    // when they are done; the retry then carries the challenge token.
+    let get_hv = |hv: pdfs_core::proton_sdk::api::HumanVerification| {
+        println!(
+            "Proton is asking for a CAPTCHA before it will accept this sign-in.\n\
+             Open this page in your browser and complete it:\n\n  {}\n",
+            auth::browser_verification_url(&hv)
+        );
+        prompt_line("Press Enter once the page says you are verified")
+            .map_err(|e| pdfs_core::Error::Other(format!("read verification answer: {e}")))?;
+        Ok(auth::browser_verified(&hv))
+    };
+
     let rt = tokio::runtime::Runtime::new()?;
-    // Solving a CAPTCHA needs a browser engine, which the CLI has no business
-    // carrying. Point at the app that does rather than failing with the raw API
-    // message, which reads as "your login is broken".
-    rt.block_on(auth::login(&username, &password, get_totp, get_mailbox))
-        .map_err(|e| match e {
-            pdfs_core::Error::HumanVerificationRequired(_) => anyhow::anyhow!(
-                "Proton is asking for a CAPTCHA before it will accept this sign-in.\n\
-                 Run `pdfs-app` and sign in there — it can show the verification page.\n\
-                 (This is usually triggered by a VPN or an unfamiliar IP; signing in from \
-                 your usual network often avoids it.)"
-            ),
-            other => anyhow::Error::new(other).context("login failed"),
-        })?;
+    rt.block_on(auth::login_interactive(
+        &username,
+        &password,
+        get_totp,
+        get_mailbox,
+        get_hv,
+    ))
+    .context("login failed")?;
 
     // A daemon that is already up is parked in `wait_for_session`, sleeping
     // between keyring checks; restart it so the mount appears now instead of