fix: revert to URL-based auth detection; remove browser headers

Every JS/cookie-based detection approach failed. Reverting to the
simplest reliable mechanism: if the WebView navigates to any non-login,
non-auth URL, the server redirected us after sign-in — fire onAuthenticated.

Also removing the browser headers added in beta.6. The 1.1.4 version
worked without them and they may be triggering server-side bot detection.
All-cookies approach (beta.8) is kept.

ClaudeChecker/Info.plist

@@ -15,9 +15,9 @@
     <key>CFBundlePackageType</key>
     <string>APPL</string>
     <key>CFBundleShortVersionString</key>
-    <string>1.2.1-beta.9</string>
+    <string>1.2.1-beta.10</string>
     <key>CFBundleVersion</key>
-    <string>57</string>
+    <string>58</string>
     <key>LSMinimumSystemVersion</key>
     <string>13.0</string>
     <key>LSUIElement</key>

ClaudeChecker/LoginView.swift

@@ -32,26 +32,13 @@ struct LoginWebView: NSViewRepresentable {
 
         func webView(_ webView: WKWebView, didFinish navigation: WKNavigation!) {
             guard !didAuthenticate else { return }
-            // Don't fire on the login/auth pages themselves
+            guard let url = webView.url?.absoluteString else { return }
-            if let url = webView.url?.absoluteString,
+            // Stay on login/auth pages — user hasn't completed sign-in yet
-               url.contains("/login") || url.contains("/auth") { return }
+            if url.contains("/login") || url.contains("/auth") { return }
-
+            // Navigated away from login — server redirected us, so sign-in completed
-            // Ask the WebView itself whether we're authenticated — it uses its own
+            didAuthenticate = true
-            // session (cookies, localStorage, etc.) so we don't need to know the
+            DispatchQueue.main.asyncAfter(deadline: .now() + 0.5) {
-            // cookie domain or name.
+                self.onAuthenticated()
-            webView.callAsyncJavaScript(
-                "const r = await fetch('/api/bootstrap', {credentials: 'include'}); return r.status;",
-                arguments: [:], in: nil, in: .page
-            ) { [weak self] result in
-                guard let self, !self.didAuthenticate else { return }
-                // JS numbers arrive as NSNumber (Double-backed), not Swift Int
-                if case .success(let val) = result,
-                   let n = val as? NSNumber, n.intValue == 200 {
-                    self.didAuthenticate = true
-                    DispatchQueue.main.asyncAfter(deadline: .now() + 0.3) {
-                        self.onAuthenticated()
-                    }
-                }
             }
         }
     }

ClaudeChecker/UsageViewModel.swift

@@ -130,13 +130,7 @@ class UsageViewModel: ObservableObject {
 
     private func claudeAPIRequest(for url: URL) async -> URLRequest {
         var req = URLRequest(url: url)
-        req.setValue("application/json, text/plain, */*", forHTTPHeaderField: "accept")
+        req.setValue("application/json", forHTTPHeaderField: "accept")
-        req.setValue("Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36", forHTTPHeaderField: "User-Agent")
-        req.setValue("https://claude.ai", forHTTPHeaderField: "Origin")
-        req.setValue("https://claude.ai/", forHTTPHeaderField: "Referer")
-        req.setValue("same-origin", forHTTPHeaderField: "sec-fetch-site")
-        req.setValue("cors", forHTTPHeaderField: "sec-fetch-mode")
-        req.setValue("empty", forHTTPHeaderField: "sec-fetch-dest")
         if let cookie = await claudeCookieHeader() {
             req.setValue(cookie, forHTTPHeaderField: "Cookie")
         }