Replace server-side cookie fetch with a browser bookmarklet

Depop's Cloudflare bot management blocks server-to-server requests to
webapi.depop.com regardless of cookie validity (confirmed: the 403 is
a Cloudflare bot-management block page, not an app-level auth error).
No amount of cookie-copying fixes that, so the fetch now runs in the
user's own browser via a bookmarklet - same real-browser context
Depop's own site already relies on - which POSTs the already-fetched
JSON to /from-browser for formatting only.

This also means the server never touches Depop or handles a Depop
cookie at all anymore, which removes an entire class of concerns from
the previous design (cookie-in-transit, CRLF injection into a proxied
header, this server being usable as a proxy to Depop's API).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>