--lan key persists across restarts; stale tabs get a readable 403

The key rotated on every server restart, stranding every phone that
held the previous cookie — during active development that guaranteed a
wall of refusals from stale polling tabs after each restart. The key
now lives in data/.lan_key (gitignored, 0600 — the Playwright-state
treatment for credential-adjacent files) and is reused across
restarts; delete the file to rotate. A keyless browser navigation now
gets a one-line HTML page saying what to do instead of raw JSON.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016jXZFSTZQKzAC8fqpWSz9g

data/titles.json

@@ -1656,7 +1656,7 @@
     "title_normalized": "botany expansion perilous perfumes poisonous carnivorous parasitic and bizarre plants"
   },
   {
-    "title_raw": "ACTION CASTLE",
+    "title_raw": "Parsely",
     "confidence": "high",
     "publisher_hint": "Memento More Computers Inc.",
     "edition_hint": "",
@@ -1666,20 +1666,7 @@
     "source_photos": [
       "IMG_4573.jpeg"
     ],
-    "title_normalized": "action castle"
-  },
-  {
-    "title_raw": "ACTION CASTLE I",
-    "confidence": "medium",
-    "publisher_hint": "",
-    "edition_hint": "",
-    "year_hint": null,
-    "language_hint": "English",
-    "art_notes": "Dark spine box among a stack of illustrated game boxes on the book cover art",
-    "source_photos": [
-      "IMG_4573.jpeg"
-    ],
-    "title_normalized": "action castle i"
+    "title_normalized": "parsely"
   },
   {
     "title_raw": "SIX-GUN SHOWDOWN",