fix(gui,cli,core): offer the CAPTCHA in the browser when the web view cannot start (B195)

The verification window now runs in its own process, so the app survives
when WebKit cannot start its sandbox on secureblue, but the CAPTCHA still
could not be solved there (#29). WebKit binds the journal socket with
`--ro-bind-try`, bubblewrap only skips a missing path, not an unreadable
one, and WebKit has no switch to leave the socket out.

Proton Mail Bridge never uses a web view: it opens verify.proton.me in the
system browser and retries with the original challenge token, typed with
the offered methods. Do the same as a fallback.

- core: `browser_verification_url` and `browser_verified` build the page
  URL and the retry credential from the challenge
- gui: when the verification window fails, a dialog opens the page in the
  browser and continues the sign-in once the user is done
- cli: `pdfs login` handles a CAPTCHA the same way instead of failing
- i18n: translate the new dialog in every catalog
- docs: B195, TROUBLESHOOTING.md, ARCHITECTURE.md, changelog

Fixes #29

docs/TROUBLESHOOTING.md

@@ -69,14 +69,16 @@ pdfs status
 ## Signing in
 
 **"Proton is asking for a CAPTCHA"** — Proton wants human verification, usually on a VPN or an
-unfamiliar network. The CLI cannot show it. Sign in with `pdfs-app`, which displays the challenge;
-the stored session then works for the CLI too.
+unfamiliar network. `pdfs login` prints the verification page's address: open it in your browser,
+complete it, then press Enter. The app shows the page in its own window.
 
-**"The verification page couldn't be opened"** — WebKit, which shows the CAPTCHA page, could not
-start its sandbox. Hardened systems such as secureblue keep its bubblewrap from the journal socket,
-and the log then shows `bwrap: Can't get type of source /run/systemd/journal/socket: Permission
-denied` and `Failed to fully launch dbus-proxy`. Check that `bwrap` and `xdg-dbus-proxy` are
-installed. If they are, sign in once with the sandbox switched off for this one run:
+**"Verify in Your Browser"** — WebKit, which shows the CAPTCHA page in the app, could not start
+its sandbox. Hardened systems such as secureblue keep its bubblewrap from the journal socket, and
+the log then shows `bwrap: Can't get type of source /run/systemd/journal/socket: Permission
+denied` and `Failed to fully launch dbus-proxy`. Choose **Open Verification Page**, complete the
+page in your browser, then choose **Continue**. If that sign-in is refused too, check that `bwrap`
+and `xdg-dbus-proxy` are installed. As a last resort, sign in once with the sandbox switched off
+for this one run:
 
 ```bash
 WEBKIT_DISABLE_SANDBOX_THIS_IS_DANGEROUS=1 pdfs-app