Add eBay Browse API integration with daily call quota

eBay marketplaces are now polled through eBay's official Buy > Browse API (client-credentials OAuth2) instead of an Apify scraper actor; Apify still handles Yahoo JP and Mercari. Browse API calls are tracked per day in a new ebay_api_usage table and capped (default 5000, configurable) on eBay's Pacific-time reset clock, so polling halts before the limit is hit. Credentials live in config.toml [ebay] and are overridable via /settings, which also surfaces the day's running call count.

Also carries the server.secure_cookies config plumbing (field, accessor, example) consumed by the following commit.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

main.go

@@ -11,6 +11,9 @@ import (
 	"os/signal"
 	"syscall"
 	"time"
+	// Embed the timezone database so eBay's Pacific-time quota reset resolves
+	// correctly even on minimal hosts without system zoneinfo.
+	_ "time/tzdata"
 
 	"veola/internal/apify"
 	"veola/internal/auth"
@@ -50,7 +53,7 @@ func run(configPath string) error {
 	defer sqlDB.Close()
 
 	store := db.NewStore(sqlDB, key)
-	authMgr, err := auth.NewManager(sqlDB, store, cfg.Security.SessionSecret)
+	authMgr, err := auth.NewManager(sqlDB, store, cfg.Security.SessionSecret, cfg.Server.UseSecureCookies())
 	if err != nil {
 		return fmt.Errorf("auth manager: %w", err)
 	}