Migrate Hyper Core simulator to first-party credentials

[merryman]

Summary

• replace the Hyper Core cookie manager and stash with a first-party credential manager and the exact client credential envelope
• seed credentials before initial navigation for local Chromium and AWS Device Farm, restricted to the matching origin
• delegate Cloudflare guest authentication to the worker instead of sending renewal credentials across that boundary
• remove the obsolete cookie CLI/config path and update simulator documentation

Depends on hypervideo/cloudflare-browser-simulator#5. Merge and deploy that worker change before releasing this simulator change.

Verification

• cargo fmt
• cargo clippy --all-targets --all-features -- -D warnings
• cargo clippy -p client-simulator-browser --lib --all-features -- -D warnings
• cargo nextest run --workspace --no-tests warn --no-fail-fast (178 tests)
• worker formatting, type-checking, linting, and 53 tests