fix(tradein): CIAN_REQUIRED_COOKIES — include real auth cookies (DMIR_AUTH, _CIAN_GK, _yasc, ...)

Original list (Stage 4 PR) was guessed without real DevTools probe; dropped DMIR_AUTH
(main Cian auth token) and several observed cookies. Updated from logged-in cian.ru
session dump (2026-05-23). Old entries kept as backward-compat fallback.
Adds regression test asserting all real DevTools cookies are present in the filter.

tradein-mvp/backend/app/services/cian_session.py

@@ -19,18 +19,33 @@ from app.services.scrapers.cian_state_parser import extract_state
 logger = logging.getLogger(__name__)
 
 # Cookies критичные для Cian auth — фильтр перед сохранением.
-# Conservative set подтверждён в Stage 4 (probe через DevTools на live session).
+# Список обновлён по реальному DevTools-дампу из logged-in сессии cian.ru (2026-05-23).
+# Старые записи оставлены как fallback (backward compat).
 CIAN_REQUIRED_COOKIES: set[str] = {
+    # --- Cian auth & session (critical) ---
+    "DMIR_AUTH",                   # Cian auth token (httpOnly) — основной auth-сигнал
+    "_CIAN_GK",                    # Cian session GUID
+
+    # --- Yandex Metrika (обычно присутствуют, не critical) ---
     "_ym_uid",
     "_ym_d",
     "_ym_isad",
+    "_ym_visorc",
+    "_yasc",                       # Yandex anti-spam
+
+    # --- Cian UX state ---
+    "uxfb_card_satisfaction",
+
+    # --- Cian session IDs (fallback / legacy deployments) ---
     "_cian_visitor_session_id",
     "_cian_app_session_id",
     "_cian_uid",
-    "_ga",
+
-    "tlsr_id",
+    # --- Misc (legacy / optional) ---
-    "cf_clearance",
+    "_ga",                         # Google Analytics
-    "session-id",
+    "tlsr_id",                     # legacy fingerprint
+    "cf_clearance",                # Cloudflare bot check
+    "session-id",                  # generic session cookie
     "anti_bot",
     "csrftoken",
 }

tradein-mvp/backend/tests/test_cian_session.py

@@ -46,6 +46,22 @@ def test_required_cookies_contains_key_names() -> None:
     assert "cf_clearance" in CIAN_REQUIRED_COOKIES
 
 
+def test_required_cookies_includes_real_auth() -> None:
+    """Real Cian DevTools probe (2026-05-23) — these cookies must pass filter."""
+    real_cookies_from_browser = {
+        "DMIR_AUTH",
+        "_CIAN_GK",
+        "_yasc",
+        "_ym_uid",
+        "_ym_d",
+        "_ym_isad",
+        "_ym_visorc",
+        "uxfb_card_satisfaction",
+    }
+    missing = real_cookies_from_browser - CIAN_REQUIRED_COOKIES
+    assert not missing, f"Filter missing real cookies: {missing}"
+
+
 # ---------------------------------------------------------------------------
 # save_session
 # ---------------------------------------------------------------------------