Handle Booking.com 2FA during main login flow

sign-in/verification was being thrown as an unrecoverable error instead
of handled via the existing SMS challenge path.

room_cal/service_api/typescript/booking/refresh-cookies.ts

@@ -313,8 +313,11 @@ export async function refresh(mode: string): Promise<CredentialsPayload> {
           { timeout: 60_000 },
         );
         if (needsChallenge(page.url())) {
-          await context.close();
-          throw new Error(`[booking] Login requires 2FA (${page.url().slice(0, 80)}) — run refresh-creds manually from a session with SMS access.`);
+          await handlePostLoginChallenge(page, smsMasked);
+          await page.waitForURL(
+            url => url.toString().includes('ses=') || url.toString().includes(`${ADMIN_BASE}/hotel`),
+            { timeout: 120_000 },
+          );
         }
       } else {
         console.error('Not logged in — waiting up to 5 minutes for manual login...');