Fix Xvfb headed Turnstile path for headless servers

- start.sh: never inject empty DISPLAY= into xvfb-run children
  (was forcing Python headless and killing Turnstile)
- headed Chromium uses base flags only; headless-only flags
  (disable-software-rasterizer/gpu) no longer applied under Xvfb
- Align closer to Git-creat7/grokRegister-cpa headed+extension path

start.sh

@@ -733,20 +733,34 @@ main() {
         export CHROMIUM_PATH
     fi
 
+    # 组装 env：绝不把空 DISPLAY= 传给子进程。
+    # 否则会覆盖 xvfb-run 自动分配的 DISPLAY，Python 侧 has_display=False → 强制 headless，
+    # Turnstile 会卡在 token长度=0（参考 grokRegister-cpa 的成功路径是纯 headed + extension）。
+    local -a env_args=(
+        "BROWSER_PREFER=${BROWSER_PREFER:-}"
+        "BROWSER_PATH=${BROWSER_PATH:-}"
+        "CHROMIUM_PATH=${CHROMIUM_PATH:-}"
+    )
+    if [ -n "${DISPLAY:-}" ]; then
+        env_args+=("DISPLAY=${DISPLAY}")
+    fi
+    if [ -n "${XAUTHORITY:-}" ]; then
+        env_args+=("XAUTHORITY=${XAUTHORITY}")
+    fi
+    if [ -n "${WAYLAND_DISPLAY:-}" ]; then
+        env_args+=("WAYLAND_DISPLAY=${WAYLAND_DISPLAY}")
+    fi
+
     if [ ${#RUN_PREFIX[@]} -gt 0 ]; then
         echo -e "${CYAN}[*] 启动命令: ${RUN_PREFIX[*]} uv run --python 3.13 python -u register_cli.py ${args[*]}${NC}"
+        echo -e "${CYAN}[*] 注意: 不向 xvfb-run 子进程注入空 DISPLAY（保留虚拟显示）${NC}"
         echo ""
         exec "${RUN_PREFIX[@]}" env \
-            BROWSER_PREFER="${BROWSER_PREFER:-}" \
-            BROWSER_PATH="${BROWSER_PATH:-}" \
-            CHROMIUM_PATH="${CHROMIUM_PATH:-}" \
-            DISPLAY="${DISPLAY:-}" \
+            "${env_args[@]}" \
             uv run --python 3.13 python -u register_cli.py "${args[@]}"
     else
         exec env \
-            BROWSER_PREFER="${BROWSER_PREFER:-}" \
-            BROWSER_PATH="${BROWSER_PATH:-}" \
-            CHROMIUM_PATH="${CHROMIUM_PATH:-}" \
+            "${env_args[@]}" \
             uv run --python 3.13 python -u register_cli.py "${args[@]}"
     fi
 }