Add Gmail+Email Worker hybrid mail path and private runtime config

Prefer Cloudflare Worker KV for verification codes with optional short IMAP
fallback disabled for private deploy; track config.json/.env for private repo.
Also add worker project, protocol mint backoff, and fail-fast Turnstile/mail
timeouts from batch runs.

cpa_xai/browser_confirm.py

@@ -216,15 +216,18 @@ def create_standalone_page(
             pass
         log(f"headed browser DISPLAY={os.environ.get('DISPLAY', '')!r}")
 
+    # Prefer Chromium: Google Chrome blocks --load-extension (turnstilePatch).
     for cand in (
+        "/snap/bin/chromium",
         "/usr/bin/chromium",
         "/usr/bin/chromium-browser",
         "/usr/bin/google-chrome",
         "/usr/bin/google-chrome-stable",
     ):
-        if os.path.isfile(cand):
+        if os.path.isfile(cand) or os.path.islink(cand):
             try:
                 opts.set_browser_path(cand)
+                log(f"browser path={cand}")
             except Exception:
                 pass
             break