fix(login): persist Amazon session by forcing rememberMe

[Multipixelone]

Problem

roomieorder login --provider amazon reported success but the worker kept hitting the sign-in wall. Confirmed from the saved cookie jar: Amazon issues its auth cookies (at-main/x-main/sess-at-main) as session cookies unless "Keep me signed in" is set, and Chrome never flushes session cookies to the on-disk profile — so the next launch (the worker) reloaded logged-out. Costco doesn't hit this because it keeps a persistent SSO cookie that survives the reload.

The "Keep me signed in" checkbox is just UI for the server-side rememberMe=true param on POST /ap/signin, and Amazon A/B-tests it away on some flows (the operator's flow never rendered it).

Fix

Force the param during the hand-login instead of depending on the checkbox:

• A login-only init script (AmazonPurchaser._login_init_script) runs ensureRememberMe(): tick an existing rememberMe control, else inject a hidden rememberMe=true into form[name="signIn"]. Fires immediately + on DOMContentLoaded + via a MutationObserver, so a late/SPA-rendered form is still caught.
• Scoped to the login context only — buy/dump never inject JS into the store's Akamai-fronted pages (AGENTS.md §3).
• Amazon then issues persistent at-main/x-main cookies that Chrome stores the normal way, like Costco's SSO cookie. No cookie juggling, rolling lifetime of months.
• verify_session() relaunches a fresh context and reports persistence honestly (a logged-in reload proves the cookies were written).

Replaces an earlier cookie capture/re-inject band-aid (never committed) that only survived browser restarts, not Amazon's short server-side token TTL.

Verified live

• After login, at-main/x-main/sess-at-main carry a +1y expiry (not SESSION).
• A fresh-launch dry-run --provider amazon reaches a logged-in Secure checkout with the real name/address and a "Place your order" button.

Tests

• Init-script presence: base/Costco returns None; Amazon drives rememberMe.
• Real-DOM-engine (@pytest.mark.browser) tests replay ensureRememberMe() against synthetic sign-in markup: ticks an existing box / injects when absent / no-ops without a form.
• Skip-slot drift net for a real sanitized /ap/signin capture (amazon_signin_form.html), mirroring the standing checkout-fixture pattern.

pytest -q: 159 passed, 3 skipped. ruff + mypy clean.

Not covered (standing caveat)

The real Place Order click + confirmation scrape (TODO(amazon)) are only reachable past a live order — unchanged AGENTS.md §1 caveat, not introduced here.