feat: filter cookies to only store required 10 based on HAR analysis

- Define REQUIRED_COOKIE_NAMES in login_helper.py (10 cookies from HAR)
- login_helper.py: import-time filtering + strict all-or-nothing validation
- pickup_api.py: save_session() filters to whitelist only (prevents accumulation)
- engine.py: unified strict check, all 10 cookies required

Based on portal-to-pickup-full-flow.har analysis:
  - All /pickup-web/a/* APIs use exactly 9 cookies
  - JSESSIONID additionally needed for portal page fetch (Referer)
  - enable_HFZrs6pXKulz is portal UI only, excluded

pickup_api.py

@@ -194,12 +194,23 @@ class PickupSession:
             return False
 
     def save_session(self, session_path: str):
-        """保存 cookies 到文件。"""
+        """保存 cookies 到文件（仅保存必需 cookie，基于 HAR 分析的白名单）。
+
+        requests.Session 会自动合并服务端 Set-Cookie 响应头，
+        可能累积非必需 cookie。保存时只保留白名单中的 cookie。
+        """
+        from login_helper import REQUIRED_COOKIE_NAMES
+        all_cookies = [
+            {"name": c.name, "value": c.value, "domain": c.domain, "path": c.path}
+            for c in self._http.cookies
+        ]
+        required = [c for c in all_cookies if c["name"] in REQUIRED_COOKIE_NAMES]
+        skipped = len(all_cookies) - len(required)
         data = {
-            "cookies": [
-                {"name": c.name, "value": c.value, "domain": c.domain, "path": c.path}
-                for c in self._http.cookies
-            ]
+            "cookies": required,
+            "total_in_session": len(all_cookies),
+            "saved": len(required),
+            "skipped": skipped,
         }
         with open(session_path, "w") as f:
             json.dump(data, f, ensure_ascii=False, indent=2)