fix(stockbit): tell a polling agent when Stockbit refuses the sign-in

A refused cookie in idx's browser was only a stderr warning, which nobody
reads under idx-mcp: stockbit_status showed `waiting` until the timeout, and
the timeout message did not mention the refusal.

- runtime::on_warning sends a thread's warnings to a sink as well as
  stderr, until its guard drops.
- The background sign-in puts its warnings in `sign_in.warning`, cleared
  once it signs in.
- The errors that end a browser wait (timeout, window closed, browser
  exited) name a refusal it hit.

Claude-Session: https://claude.ai/code/session_01RqPPVeVDrnLoP7NUZmLRxY

web/src/content/docs/cli/stockbit.md

@@ -173,7 +173,9 @@ a browser window opens on Stockbit's sign-in page (`"method": "browser"`) and
 you sign in there. Over SSH or without a display, the answer carries the page
 URL and its `ssh -L` forward (`"method": "page"`) for the agent to hand you.
 The agent then polls `stockbit_status` until `sign_in.state` is `signed_in`
-or `failed`. A session that already works answers `signed_in` without opening
+or `failed`. While it waits, `sign_in.warning` carries the latest problem, such
+as Stockbit refusing the session you signed in with, so the agent can tell you
+to sign in again. A session that already works answers `signed_in` without opening
 anything, a second call while one is waiting returns it again, and
 `{"method": "page"}` or `{"method": "browser"}` picks the way. If the server
 stops while the window waits, the window closes with it.