- Remove response cookie write-through (was poisoning fresh TLS sessions
  with stale WAF-bound cookies)
- Add fresh-session-first rotation: 403 now rebuilds TLS before switching
  to Safari, clearing domain cookies to avoid rehydrating tainted ones
- Bump max_rotations default 1 -> 2 to budget fresh session + Safari
- Change cache_dir default to None (solver cookies only, no stale cache)
- Fail fast on BrowserSolver() when patchright is not installed
- Fix embed mode: Sec-Fetch-Site computed dynamically, Accept set at
  client level to avoid HTTP/2 duplication
- Update tests, README, llms.txt, and ref-sec-fetch docs