feat: validate credentials on :CP <platform> login (#310)

## Problem

`:CP <platform> login` blindly caches username/password without
server-side
validation. Bad credentials are only discovered at submit time, which is
confusing and wastes a browser session.

## Solution

Wire `:CP <platform> login` through the scraper pipeline so each
platform
actually authenticates before persisting credentials. On failure, the
user
sees an error and nothing is cached.

- CSES: reuses `_check_token` (fast path) and `_web_login`; returns API
token
  in `LoginResult.credentials` so subsequent submits skip re-auth.
- AtCoder/Codeforces: new `_login_headless` functions open a
StealthySession,
solve Turnstile/Cloudflare, fill the login form, and validate success by
  checking for the logout link. Cookies only persist on confirmed login.
- CodeChef/Kattis/USACO: return "not yet implemented" errors.
- `scraper.lua`: generalizes submit-only guards (`needs_browser` flag)
to
  cover both `submit` and `login` subcommands.
- `credentials.lua`: prompts for username/password, passes cached token
for
CSES fast path, shows ndjson status notifications, only caches on
success.

lua/cp/credentials.lua

@@ -1,34 +1,70 @@
 local M = {}
 
 local cache = require('cp.cache')
+local constants = require('cp.constants')
 local logger = require('cp.log')
 local state = require('cp.state')
 
+local STATUS_MESSAGES = {
+  checking_login = 'Checking existing session...',
+  logging_in = 'Logging in...',
+  installing_browser = 'Installing browser...',
+}
+
 function M.login(platform)
   platform = platform or state.get_platform()
   if not platform then
     logger.log(
-      'No platform specified. Usage: :CP login <platform>',
+      'No platform specified. Usage: :CP <platform> login',
       { level = vim.log.levels.ERROR }
     )
     return
   end
 
-  vim.ui.input({ prompt = platform .. ' username: ' }, function(username)
+  local display = constants.PLATFORM_DISPLAY_NAMES[platform] or platform
+
+  vim.ui.input({ prompt = display .. ' username: ' }, function(username)
     if not username or username == '' then
       logger.log('Cancelled', { level = vim.log.levels.WARN })
       return
     end
     vim.fn.inputsave()
-    local password = vim.fn.inputsecret(platform .. ' password: ')
+    local password = vim.fn.inputsecret(display .. ' password: ')
     vim.fn.inputrestore()
     if not password or password == '' then
       logger.log('Cancelled', { level = vim.log.levels.WARN })
       return
     end
+
     cache.load()
-    cache.set_credentials(platform, { username = username, password = password })
-    logger.log(platform .. ' credentials saved', { level = vim.log.levels.INFO, override = true })
+    local existing = cache.get_credentials(platform) or {}
+    local credentials = {
+      username = username,
+      password = password,
+    }
+    if existing.token then
+      credentials.token = existing.token
+    end
+
+    local scraper = require('cp.scraper')
+    scraper.login(platform, credentials, function(ev)
+      vim.schedule(function()
+        local msg = STATUS_MESSAGES[ev.status] or ev.status
+        logger.log(display .. ': ' .. msg, { level = vim.log.levels.INFO, override = true })
+      end)
+    end, function(result)
+      vim.schedule(function()
+        if result.success then
+          logger.log(
+            display .. ' login successful',
+            { level = vim.log.levels.INFO, override = true }
+          )
+        else
+          local err = result.error or 'unknown error'
+          logger.log(display .. ' login failed: ' .. err, { level = vim.log.levels.ERROR })
+        end
+      end)
+    end)
   end)
 end
 
@@ -36,14 +72,15 @@ function M.logout(platform)
   platform = platform or state.get_platform()
   if not platform then
     logger.log(
-      'No platform specified. Usage: :CP logout <platform>',
+      'No platform specified. Usage: :CP <platform> logout',
       { level = vim.log.levels.ERROR }
     )
     return
   end
+  local display = constants.PLATFORM_DISPLAY_NAMES[platform] or platform
   cache.load()
   cache.clear_credentials(platform)
-  logger.log(platform .. ' credentials cleared', { level = vim.log.levels.INFO, override = true })
+  logger.log(display .. ' credentials cleared', { level = vim.log.levels.INFO, override = true })
 end
 
 return M