Explain why Cloudflare can still 403 after pasting cookies and User-Agent (#34)

[builtbyproxy]

Closes #34.

What's broken

A user (@Peeel in #34) pasted their Brave cookies and matching User-Agent exactly as the README instructed, and the sync still failed every run with this error in the log:

Failed to sync "Forgotten" (TMDb:488623) for "rmn": "TMDb lookup returned 403 for /tmdb/488623 after retries. Cloudflare is blocking. Try providing raw cookies."

The error says "try providing raw cookies", but they already had. That's a dead end for the user, they have no idea what to do next, and the README's "Cloudflare issues" section stops at "paste cookies and UA" too, so there's nowhere to look it up.

Why it happens

Cloudflare's cf_clearance has three constraints beyond cookie value + User-Agent that the error message and README never spelled out:

1. IP pinning. Cloudflare ties cf_clearance to the IP address that solved the challenge, not just the UA. If Jellyfin's egress IP differs from the browser's (different machine, VPN, mobile tether, datacenter), the token is rejected even though the cookie is correct.
2. Short TTL. A cf_clearance from a managed challenge often expires in about 30 minutes. A token pasted in advance can be dead by the time the scheduled sync actually runs.
3. Connection fingerprint. Cloudflare also fingerprints the TLS handshake and HTTP/2 behaviour. A .NET HTTP client doesn't look like a real browser at that layer, so on a domain in bot-fight mode the right cookie may not be enough.

The maintainer reply in #34 lays out all three, this PR just lifts that explanation into the code and the docs so future users don't have to find the issue thread.

What this PR does

• LetterboxdSync/LetterboxdScraper.cs: rewrote the TMDb 403 exception message. Instead of "Try providing raw cookies." (which the user has already done) it now names the three likely causes and points at the README section by name.
• README.md: added a new "Still 403ing after pasting Raw Cookies and a matching User-Agent" subsection under "Cloudflare issues", explaining the three causes in plain English with a concrete fix per cause ("paste fresh cookies from a browser on the same network as the Jellyfin server", "trigger the sync immediately rather than waiting for the scheduled run", "there isn't much the plugin can do about this one"). Dropped the now-duplicate "the cookie expires periodically" line, the new subsection covers it.

Not touched on purpose:

• The partial-results log lines in GetWatchlistTmdbIdsAsync and GetDiaryFilmEntriesAsync, the sign-in 403 in LetterboxdAuth.cs, and the dashboard JS error in userPage.html. They have the same "try raw cookies" framing and would benefit from the same rewrite, but the change set is kept tight to the path that fired in the issue's log. Easy follow-up.
• The "manual TMDb ID maps to Letterboxd slug" workaround flagged in the issue comment. That's a real feature (storage, UI on the account page, lookup short-circuit, tests) and warrants its own design pass.

How to test

• dotnet build -c Release clean (build succeeded, only pre-existing test-project warnings).
• dotnet test -c Release passes 431/431 in 35s, same as main. No test referenced the old exception string.
• Render the README on GitHub and confirm the new subsection lays out cleanly under the existing "Cloudflare issues" heading.
• Manual reproduction of the 403 path (block letterboxd.com locally, run a sync) is the only way to see the new exception text end-to-end, and is optional given there's no test that hits this path.

Follow-ups (not in this PR)

• Same plain-English rewrite for the other three Cloudflare error surfaces: LetterboxdScraper.cs partial-results log lines, LetterboxdAuth.cs:118 sign-in 403, and the "Blocked by Cloudflare. Try adding Raw Cookies with cf_clearance." string in userPage.html.
• Design and ship the manual TMDb-to-slug override so a single stuck film can be worked around without hitting the Cloudflare-protected lookup at all.

[codecov]

Codecov Report

❌ Patch coverage is 0% with 7 lines in your changes missing coverage. Please review.
✅ Project coverage is 78.7%. Comparing base (0e9c0da) to head (477d405).
⚠️ Report is 6 commits behind head on main.

Files with missing lines	Patch %	Lines
LetterboxdSync/LetterboxdScraper.cs	0.0%	7 Missing ⚠️

❌ Your patch check has failed because the patch coverage (0.0%) is below the target coverage (70.0%). You can increase the patch coverage or adjust the target coverage.

Additional details and impacted files

@@           Coverage Diff           @@
##            main     #39     +/-   ##
=======================================
- Coverage   78.9%   78.7%   -0.2%     
=======================================
  Files         28      28             
  Lines       2401    2407      +6     
  Branches     436     436             
=======================================
  Hits        1895    1895             
- Misses       393     399      +6     
  Partials     113     113             

Files with missing lines	Coverage Δ
LetterboxdSync/LetterboxdScraper.cs	72.5% <0.0%> (-2.0%)	⬇️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.