fix(auth): accept bare session tokens from cookie env vars

parseBrowserAuthInput returns an access-only credential for a bare
__Secure-next-auth.session-token value, which /perplexity-login
--browser accepts but credentialsFromEnvironment rejected because it
required .cookies. Only reject when parsing fails entirely.

src/auth/login.ts

@@ -58,7 +58,7 @@ function credentialsFromEnvironment(): StoredToken | null {
     const value = normalizeInput(process.env[key]);
     if (value) {
       const credentials = parseBrowserAuthInput(value);
-      if (!credentials?.cookies) {
+      if (!credentials) {
         throw new AuthError(
           "NO_TOKEN",
           `${key} is set but does not contain a signed-in Perplexity browser cookie. ${browserAuthFailureMessage(value)}`,

test/auth/login.test.ts

@@ -314,6 +314,30 @@ describe("auth/login", () => {
     expect(saveTokenMock).toHaveBeenCalledTimes(1);
   });
 
+  test("authenticate accepts a bare session token from PI_PERPLEXITY_COOKIE", async () => {
+    process.env.PI_AUTH_NO_BORROW = "1";
+    const browserToken = createJwt(Date.now() + 2 * 60 * 60 * 1000);
+    process.env.PI_PERPLEXITY_COOKIE = browserToken;
+
+    const loadTokenMock = mock(async () => null);
+    const saveTokenMock = mock(async (_token: StoredToken) => undefined);
+    const clearTokenMock = mock(async () => undefined);
+
+    mock.module("../../src/auth/storage.js", () => ({
+      loadToken: loadTokenMock,
+      saveToken: saveTokenMock,
+      clearToken: clearTokenMock,
+    }));
+
+    const { authenticate } = await importLoginModule();
+
+    const token = await authenticate();
+
+    expect(token.access).toBe(browserToken);
+    expect(token.cookies).toBe(undefined);
+    expect(saveTokenMock).toHaveBeenCalledTimes(1);
+  });
+
   test("authenticate rejects PI_PERPLEXITY_COOKIE without a signed-in session cookie", async () => {
     process.env.PI_AUTH_NO_BORROW = "1";
     process.env.PI_PERPLEXITY_COOKIE = "pplx.visitor-id=visitor; cf_clearance=clearance";