Add a browser render check, and fix the login error it found

tools/render_check.py drives the real UI in Playwright's Chromium and asserts
what a person actually sees: the login gate, live search narrowing on a spec
value, the quick-adjust buttons, the category spec template pre-filling and
switching the unit to grams, the settings and password panels, and the phone
layout at a true 390px viewport.

Playwright's own Chromium rather than the installed Chrome: headless Chrome
returns nothing while a desktop Chrome is open, silently enough that it reads
as the app being broken.

It found a real bug on its first run. The fetch helper treated any 401 as a
lapsed session, so a wrong password bounced to "Not authenticated" instead of
saying the password was wrong. 401s from the login call itself are now left to
report their own reason.

It also confirmed the CSP is doing its job from the other direction:
Playwright's wait_for_function compiles predicates with eval() and is refused,
so the check polls from Python rather than the app loosening script-src.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

README.md

@@ -57,6 +57,21 @@ and asset versioning, login throttling on both the login and change-password
 routes, and the full password-management flow including scrypt hashing, session
 invalidation and the recovery CLI.
 
+`tools/render_check.py` drives the real UI in a browser and asserts what a
+person would see: that the JavaScript runs under the Content-Security-Policy,
+that a wrong password says so, that picking "Filament" pre-fills its spec
+template and switches the unit to grams, that the password section works, and
+that nothing overflows on a 390px phone.
+
+```sh
+.venv/bin/python -m playwright install chromium   # once
+.venv/bin/python -m tools.render_check --keep-shots /tmp/shots
+```
+
+It uses Playwright's own Chromium deliberately: headless Chrome driving the
+installed browser returns nothing at all while a desktop Chrome is open, which
+is silent enough to look like the app is broken.
+
 `test_concurrency` needs a real server process, because a lost update only shows
 up when two requests genuinely overlap inside SQLite. It fires overlapping
 adjustments, patches and creates at one part and asserts the stock log always