Auto headless + Xvfb for headless servers

Enable Chromium on machines without DISPLAY: Python auto headless
with Xvfb hints, and start.sh installs/starts Xvfb (xvfb-run or
persistent :99) so registration can run headed under a virtual display.

cpa_xai/browser_confirm.py

@@ -203,18 +203,33 @@ def create_standalone_page(
             except Exception as e:  # noqa: BLE001
                 log(f"extension add failed: {e}")
 
-    if headless:
+    # Auto-headless when no display (Linux server). Prefer register helpers if present.
+    display = (os.environ.get("DISPLAY") or "").strip()
+    wayland = (os.environ.get("WAYLAND_DISPLAY") or "").strip()
+    has_disp = sys.platform == "win32" or bool(display or wayland)
+    effective_headless = bool(headless) or not has_disp
+    if effective_headless and not headless and not has_disp:
+        log(
+            f"no DISPLAY/WAYLAND (DISPLAY={display!r}) — auto headless; "
+            "prefer: xvfb-run -a ... for better Turnstile success"
+        )
+    if effective_headless:
         try:
             opts.headless(True)
         except Exception:
             opts.set_argument("--headless=new")
+        for flag in ("--headless=new", "--disable-gpu", "--no-sandbox", "--disable-dev-shm-usage"):
+            try:
+                opts.set_argument(flag)
+            except Exception:
+                pass
         log("headless=True (may hit Cloudflare / break real clicks)")
     else:
         try:
             opts.headless(False)
         except Exception:
             pass
-        log(f"headed browser DISPLAY={os.environ.get('DISPLAY', '')!r}")
+        log(f"headed browser DISPLAY={display!r}")
 
     # Prefer Chromium: Google Chrome blocks --load-extension (turnstilePatch).
     for cand in (