docs: record accepted Phase 2 decisions (patchright scraper, 2FA)

- §9 Technology: scraper is patchright (headless Playwright); the
  pi-browser-harness gets a Cloudflare 403 managed challenge on the login POST.
- §13 Resolved: add the patchright decision and the 2FA finding (the Compass
  parent login required no two-factor or one-time code during the Phase 2 proof).
- §13 Remaining: Teams two-factor auth is still unverified.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

AGENTS.md

@@ -156,7 +156,7 @@ The Hub interface is frozen in `central_ai_llm_master/docs/ask-contract.md`.
 | Backend | **Go** |
 | UI | **HTMX** + server-rendered HTML |
 | Database | **SQLite** |
-| Scraper | **pi-browser-harness** (Python fallback allowed if the harness cannot do it) |
+| Scraper | **patchright** (headless Playwright). The **pi-browser-harness** cannot do the daily scan: it gets a Cloudflare **403 managed challenge** on the login POST. |
 | Design | Family Home Lab `tokens.css` |
 | Host | `.13`, Docker |
 | Container | **This project's own** image and compose file. |
@@ -235,8 +235,13 @@ Resolved:
 6. **Focus:** Compass gives the daily schedule; Teams gives homework and assignments.
 7. **Trigger time: 6:00 am.**
 8. **Apprise channels: Email and WhatsApp.**
+9. **Scraper = patchright.** The daily scan uses patchright (headless Playwright).
+   The pi-browser-harness cannot pass the Cloudflare managed challenge on the login POST.
+10. **2FA:** the Compass parent login required no two-factor or one-time code during
+    the Phase 2 proof.
 
 Remaining:
 1. **Teams scope:** find the smallest section that answers "what is overdue". Teams
    may be hard to reach. This is a decision for the brief and for Phase 2.
-2. If Compass or Teams uses two-factor auth, what is the manual step?
+2. **Teams two-factor auth:** not verified. Confirm whether Teams needs 2FA, then
+   define the manual step.