feat: login recipe auto-discovery (discover command)

- discover <source>: open homepage → find login entry by visible text
  (fallback to common login paths) → click/open → detect main-frame vs
  iframe form (captcha/challenge iframes excluded) → enumerate fields →
  generate recipe (single-page / two-step / password-only) with
  remember-me checkbox ticking → write logins/<source>.json → optional
  live login verification (--no-login to skip)
- loggedOutText: login-state check by visible button/link text
  (regex), for sites whose login control has no stable class
- honest boundaries: CAPTCHA/OTP/perimeter protection exits with a
  clear human-required message and writes nothing (validated against
  wsj's DataDome layer); validated green path against nikkei Piano ID