Fix browser auth fallback

[gardinermichael]

Summary

• retry failed local headless authentication in a visible Chromium window
• allow headed browser launches without enabling debug logging
• keep the fallback browser open for 30 seconds by default so users can select or sign into a Google account
• preserve explicit -keep-open durations and skip the fallback for remote CDP and pre-launch profile errors

Root cause

Chrome can load a copied signed-in profile differently in headless mode and redirect NotebookLM to Google's account chooser. The existing auth flow treated that redirect as expired authentication and exited, even though the same profile could authenticate in a visible browser.

User impact

nlm auth login remains headless-first. When Google rejects or cannot restore that headless session, nlm now opens a visible browser once and gives the user time to complete account selection before harvesting credentials.

Validation

• go test ./...
• built and installed the patched CLI on macOS
• reproduced the headless failure and verified the visible fallback updates ~/.nlm/env
• verified nlm notebook list --limit 1 succeeds with the refreshed credentials