Make browser sidecar on-demand (#44)

docker-compose.yml

@@ -122,6 +122,8 @@ services:
       # The zone *name*, which is what Chrome's ICU needs — see chrome/entrypoint.sh.
       # Absent on a non-Debian host, which the entrypoint handles by falling back to UTC.
       - /etc/timezone:/etc/timezone:ro
+      # Cloudflare clearance must survive Chrome reaping and image recreation.
+      - chrome-profile:/home/chrome/profile
     # Chrome allocates shared memory per tab and dies on Docker's 64MB default.
     shm_size: '1gb'
     # Reaps zombie renderer processes, which otherwise accumulate for the
@@ -143,6 +145,7 @@ volumes:
   # declared here: undeclared means `docker compose down -v` cannot take it
   # with the rest, so the old database survives the cutover until someone
   # removes it by hand.
+  chrome-profile:
 
 networks:
   # Not `internal: true`: headless Chrome still needs outbound access to reach