feat: Ford legacy support, EMEX browser pooling, collapsible sidebar

- Add PL24 Ford legacy service for fordt_parts architecture
- Refactor EMEX to use persistent browser pool instead of per-call instances
- Make vehicle decode resilient: fallback to PL24 when Corgi doesn't recognize VIN
- Add collapsible sidebar with persistent user preference
- Improve brand access guard and categories service
- Add debug/test scripts for VIN e2e testing

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/api/src/integrations/pl24/pl24-auth.service.ts

@@ -276,6 +276,34 @@ export class PL24AuthService {
     return headers;
   }
 
+  /**
+   * Build headers for Ford legacy HTML page requests.
+   * Uses text/html Accept instead of application/json.
+   */
+  async buildFordLegacyHeaders(
+    serviceName: string,
+  ): Promise<Record<string, string>> {
+    const token = await this.authorizeService(serviceName);
+    const sessionCookie = await this.getSessionCookie();
+
+    return {
+      Authorization: `Bearer ${token}`,
+      Cookie: sessionCookie,
+      Accept: "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
+      "User-Agent":
+        "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
+    };
+  }
+
+  /**
+   * Get PL24TOKEN cookie value for Ford hintstoken parameter.
+   */
+  getPL24TokenValue(): string | null {
+    if (!this.tokenData?.sessionCookie) return null;
+    const match = this.tokenData.sessionCookie.match(/PL24TOKEN=([^;]+)/);
+    return match?.[1] || null;
+  }
+
   private isTokenValid(token: PL24TokenData): boolean {
     const bufferMs = 60 * 1000;
     return token.expiresAt.getTime() - bufferMs > Date.now();