Prefer Chromium for turnstilePatch on headless servers

Google Chrome blocks --load-extension, so CF tokens stay empty under
Xvfb. Auto-select Chromium when the extension is present, install/
detect chromium in start.sh, and document browser_prefer overrides.

register_cli.py

@@ -59,7 +59,8 @@ def _patched_create_browser_options():
     except Exception:
         pass
 
-    # Prefer Google Chrome for registration reliability; Chromium fallback for extension.
+    # Prefer register resolve_browser_path (Chromium first when turnstilePatch exists).
+    # Do NOT force Google Chrome here — Chrome blocks --load-extension and CF often fails.
     browser_path = None
     resolve = getattr(reg, "resolve_browser_path", None)
     if callable(resolve):
@@ -69,11 +70,11 @@ def _patched_create_browser_options():
             browser_path = None
     if not browser_path:
         for cand in (
-            "/usr/bin/google-chrome-stable",
-            "/usr/bin/google-chrome",
-            "/snap/bin/chromium",
             "/usr/bin/chromium",
             "/usr/bin/chromium-browser",
+            "/snap/bin/chromium",
+            "/usr/bin/google-chrome-stable",
+            "/usr/bin/google-chrome",
         ):
             if os.path.isfile(cand) or os.path.islink(cand):
                 browser_path = cand
@@ -103,10 +104,15 @@ def _patched_create_browser_options():
             and "chromium" not in browser_path
         )
         if is_chrome:
-            print("[ext] skip turnstilePatch on Google Chrome (--load-extension blocked)", flush=True)
+            print(
+                "[ext] skip turnstilePatch on Google Chrome (--load-extension blocked); "
+                "install chromium or set browser_prefer=chromium",
+                flush=True,
+            )
         else:
             try:
                 opts.add_extension(ext_path)
+                print(f"[ext] turnstilePatch loaded: {ext_path}", flush=True)
             except Exception:
                 pass