--lan key persists across restarts; stale tabs get a readable 403

The key rotated on every server restart, stranding every phone that
held the previous cookie — during active development that guaranteed a
wall of refusals from stale polling tabs after each restart. The key
now lives in data/.lan_key (gitignored, 0600 — the Playwright-state
treatment for credential-adjacent files) and is reused across
restarts; delete the file to rotate. A keyless browser navigation now
gets a one-line HTML page saying what to do instead of raw JSON.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016jXZFSTZQKzAC8fqpWSz9g

data/title_removals.json

@@ -64,5 +64,11 @@
     "photos": [
       "IMG_4507.jpeg"
     ]
+  },
+  {
+    "title": "ACTION CASTLE I",
+    "photos": [
+      "IMG_4573.jpeg"
+    ]
   }
 ]