auth: persistent browser profile, credential autofill, and a real SiteMinder probe URL

Three related problems in the browser capture flows (`SessionManager`, `SpoSessionManager`):

1. **Every capture launches a fresh Playwright profile**, so Entra/SiteMinder see a brand-new device each time: full email + password + MFA on every capture. With a persistent profile (`launchPersistentContext` on a 0700 directory under `~/.workflow-suite`), one "stay signed in" login makes subsequent captures complete silently until the IdP session expires.

2. **No credential autofill.** When a full login is needed, the user types their IDIR credentials into the capture window by hand. Best-effort autofill from env (`IDIR_USERNAME`/`IDIR_PASSWORD`, falling back to `ATLASSIAN_EMAIL`/`ATLASSIAN_PASSWORD`, which already hold the same IDIR credentials) removes the typing. MFA stays deliberately manual — automating the second factor onto the same machine as the password would collapse it into one factor.

3. **`SessionManager` probes an anonymously readable endpoint** (`/rest/api/space?limit=1`). Confluence answers the JSON without a SiteMinder challenge, no SMSESSION is ever minted, and the capture polls until timeout (observed live 2026-08-17). The probe must target a protected resource so the challenge actually fires.

Both managers duplicate near-identical inline Playwright scripts; a shared capture-script builder fixes all three once.

Start with the SessionManager and SpoSessionManager browser capture flows and compare their duplicated inline Playwright scripts. Verify how launchPersistentContext, the credential environment variables, and the current Confluence probe are handled; done means a shared builder supports the persistent profile and best-effort autofill, while the probe reaches a protected resource and MFA remains manual.

Written by the indexing model from the issue text.