feat(clearance): add clearance smoke gate and session-safe integration

[ChechiDev]

Pre-flight Checks

• I have searched existing issues and this is not a duplicate
• I understand this issue needs status:approved before a PR can be opened

Problem Description

SportCrawl needs a safe clearance/session integration path before real browser-based clearance smoke can be attempted. The current buffering work validates work dispatch buffering, but not a cf_clearance/session pool or a bounded clearance capture gate.

Proposed Solution

Add a validation-only /api/clearance backend endpoint, align the Chrome extension payload and local-only runtime config, harden logging redaction for clearance/session-sensitive fields, and add CLI smoke commands that keep real browser/network smoke gated.

The implementation must preserve safety:

• no raw token, cookie, cf_clearance, profile path, CDP, HTML, DSN, or secret output;
• no DB persistence for clearance/session state in this slice;
• no Docker/browser/network execution as part of unit tests;
• smoke-clearance remains dry-run/fake-local until explicit real-smoke authorization.

Affected Area

Other

Alternatives Considered

Continue using player-info smoke commands, but they can touch DB/scrape_queue and are not safe as a clearance-only smoke harness.