Prefer Chromium for turnstilePatch on headless servers

Google Chrome blocks --load-extension, so CF tokens stay empty under
Xvfb. Auto-select Chromium when the extension is present, install/
detect chromium in start.sh, and document browser_prefer overrides.

auto_register.py

@@ -184,12 +184,13 @@ def save_account(email: str, password: str, sso: str = ""):
 
 def resolve_browser_path() -> str | None:
     # Prefer Chromium: Google Chrome blocks --load-extension (turnstilePatch).
+    # Chrome-first order often leaves Turnstile token=0 on Xvfb servers.
     for cand in (
-        "/snap/bin/chromium",
         "/usr/bin/chromium",
         "/usr/bin/chromium-browser",
-        "/usr/bin/google-chrome",
+        "/snap/bin/chromium",
         "/usr/bin/google-chrome-stable",
+        "/usr/bin/google-chrome",
     ):
         if os.path.isfile(cand) or os.path.islink(cand):
             return cand