Sniff Matrix token via www.reddit.com/chat/ + cookie dump endpoint

chat.reddit.com now redirects to www.reddit.com/chat/, and that SPA was
bouncing automated logins to the /login/ wall (confirmed via the new
matrix-debug.png endpoint — the captured screenshot shows the login UI,
not the chat surface, despite isLoggedIn() returning true seconds
earlier). Going direct to the canonical URL means the session cookie set
by the automated /login form-fill is applied to the very first request
instead of only after a cross-subdomain redirect, which is where it was
getting dropped. Switch goto from awaited domcontentloaded on the old
URL to a non-awaited domcontentloaded on the new URL so the request
listener can resolve the moment the SPA fires its first authed call to
matrix.redditspace.com.

Adds GET /api/debug/cookies as a temporary diagnostic — returns cookies
visible to www.reddit.com, chat.reddit.com, and matrix.redditspace.com
(values hashed by default; ?reveal=1 to dump raw). Lets us compare what
the browser holds vs. what /chat/ rejects if this doesn't fix it.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/web/routes/debug.ts

@@ -21,6 +21,45 @@ export function createDebugRouter(ctx: WebContext): Router {
     res.sendFile(p);
   });
 
+  // Dumps the browser context's cookies (names + metadata only — values are
+  // hashed) so we can tell which session/OAuth cookies are set after the
+  // auto-login and which the chat surface might be missing.
+  router.get('/debug/cookies', async (req, res) => {
+    const browser = ctx.services.browser;
+    if (!browser) {
+      res.status(500).json({ error: 'Browser client not initialized' });
+      return;
+    }
+    const context = browser.getContext();
+    if (!context) {
+      res.status(500).json({ error: 'Browser context not available' });
+      return;
+    }
+    try {
+      const reveal = req.query.reveal === '1';
+      const urls = ['https://www.reddit.com', 'https://chat.reddit.com', 'https://matrix.redditspace.com'];
+      const out: Record<string, unknown> = {};
+      for (const u of urls) {
+        const cookies = await context.cookies(u);
+        out[u] = cookies.map((c) => ({
+          name: c.name,
+          domain: c.domain,
+          path: c.path,
+          httpOnly: c.httpOnly,
+          secure: c.secure,
+          sameSite: c.sameSite,
+          expires: c.expires,
+          valueLen: c.value.length,
+          value: reveal ? c.value : undefined,
+        }));
+      }
+      res.json(out);
+    } catch (error) {
+      ctx.logger.error('Cookie dump failed:', error);
+      res.status(500).json({ error: String(error) });
+    }
+  });
+
   router.post('/debug/inspect-dom', async (req, res) => {
     if (!ctx.services.chat) {
       res.status(500).json({ error: 'Chat service not initialized' });