feat: add Docker-based cookie refresh to avoid Playwright+Chromium dependency

[cschanhniem]

Problem

The current cookie refresh mechanism (scripts/refresh_cookies.py) requires Python + Playwright with a full Chromium browser download. For a self-hosted tool, this introduces a heavy (~300 MB) dependency chain just to perform a periodic credential refresh.

# scripts/refresh_cookies.py — requires Playwright with Chromium
from playwright.sync_api import sync_playwright
# ... launches headless Chromium to drive a SAML/form-login flow

The project's README already lists mkcert and bun as prerequisites; adding Python + Playwright + a full browser binary to that list raises the barrier for new users who just want to archive their TeamPlus messages.

Evidence

The Makefile and scripts/refresh.sh both invoke this Python script:

# Makefile (relevant section)
refresh-cookies:
\t./scripts/refresh_cookies.py

# scripts/refresh.sh
./scripts/refresh_cookies.py

The only alternative is running a persistent GitHub Actions cron (scripts/refresh_and_upload_cf.sh), which covers Cloudflare-deployed setups but adds CI dependency for non-CF deployments.

Suggested approach

Provide a Docker-based refresh option (docker-compose.refresh.yml or a standalone Dockerfile.refresh) that bundles Python, Playwright, and Chromium in a container:

services:
  cookie-refresh:
    build:
      dockerfile: Dockerfile.refresh
    volumes:
      - ./.cookies:/cookies
      - ./.env:/app/.env:ro
    environment:
      - COOKIE_TTL_HOURS=168
    restart: on-failure

This way users only need Docker (already common for self-hosted deployments) instead of managing a Python + Playwright + Chromium toolchain on the host. The container can be scheduled via the host's cron or Docker's built-in restart policy.