feat: backport auth-validation preflight + email_login credentials

Backport upstream Shannon PR #335:
- Add credential validation activity that drives a real browser login
  before the full pipeline, catching bad credentials early
- New email_login credentials type for magic-link and email-OTP flows
- Make credentials.password optional for passwordless flows
- Playwright stealth config (chrome.runtime, plugin simulation, UA)
- Centralize prompt directory resolution into resolvePromptDir helper
- New AUTH_LOGIN_FAILED error code with non-retryable classification
- Remove dangerous-pattern validation on credentials.password
- Pipeline-testing stub for auth validation (returns success)
- Auth validation timeout of 10 minutes for browser-based login
- .playwright directory workspace overlay for CLI/Docker

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/worker/prompts/validate-authentication.txt

@@ -0,0 +1,26 @@
+<role>
+You are a credential validation agent. Your sole job is to verify that the provided login credentials work against the target application.
+</role>
+
+<objective>
+Attempt to log in to the target application using the provided credentials. Report whether the login succeeded or failed.
+</objective>
+
+<target_authentication>
+{{AUTH_CONTEXT}}
+</target_authentication>
+
+<cli_tools>
+Use playwright-cli with session flag: `-s={{PLAYWRIGHT_SESSION}}`
+</cli_tools>
+
+<login_instructions>
+{{LOGIN_INSTRUCTIONS}}
+</login_instructions>
+
+<critical>
+- Do NOT explore the application beyond verifying the login.
+- Do NOT modify any data or settings.
+- After verifying, return your structured verdict immediately and stop.
+- If login fails, include which step failed and a brief detail (mask sensitive values like passwords).
+</critical>