Prefer Chromium for turnstilePatch on headless servers

Google Chrome blocks --load-extension, so CF tokens stay empty under
Xvfb. Auto-select Chromium when the extension is present, install/
detect chromium in start.sh, and document browser_prefer overrides.

cpa_xai/browser_confirm.py

@@ -233,11 +233,11 @@ def create_standalone_page(
 
     # Prefer Chromium: Google Chrome blocks --load-extension (turnstilePatch).
     for cand in (
-        "/snap/bin/chromium",
         "/usr/bin/chromium",
         "/usr/bin/chromium-browser",
-        "/usr/bin/google-chrome",
+        "/snap/bin/chromium",
         "/usr/bin/google-chrome-stable",
+        "/usr/bin/google-chrome",
     ):
         if os.path.isfile(cand) or os.path.islink(cand):
             try: