fix(yahoo): use curl-impersonate for crumb auth (TLS fingerprinting)

Yahoo Finance blocks standard ureq/rustls via TLS fingerprinting (JA3/JA4).
Reverse-engineered from yfinance source: they use curl_cffi with Chrome impersonation.

Fix:
- Fetch cookie via curl-impersonate from fc.yahoo.com
- Fetch crumb via curl-impersonate from query1.finance.yahoo.com/v1/test/getcrumb
  (correct URL: getcrumb, not getCrumb or csrfToken)
- Parse Netscape cookie jar format, send cookies as header to quoteSummary
- 401 retry: clear crumb + cookie jar, re-auth on next attempt
- Crumb validation: reject HTML, empty, rate-limit responses
- Add curl-impersonate-chrome to flake.nix devShell

flake.nix

@@ -28,6 +28,7 @@
             cargo-watch
             cargo-nextest
             prek
+            curl-impersonate-chrome  # required for Yahoo Finance auth (--impersonate chrome)
           ];
 
           env = {