Add P4N_SESSION_COOKIE for p4n2gpx, since login alone can't work headless

Traced the plugin's "Login failed" error directly against
park4night.com: correct credentials still get rejected because the
login form is behind invisible reCAPTCHA, which only a real browser
ever satisfies. p4n2gpx.rb (outside this repo) now checks
P4N_SESSION_COOKIE first and uses it as-is, skipping the login POST
entirely — the cookie comes from an already-authenticated browser,
copied out by hand and refreshed when it expires. Wired the env var
through docker-compose.yaml and the deploy workflow's "Write .env"
step the same way as P4N_USER/P4N_PASSWORD.

docker-compose.yaml

@@ -35,9 +35,15 @@ services:
       # part of this repo — see docs/deployment.adoc) if that private
       # plugin is present; blank just means it fails with its own "could
       # not authenticate" error when run, same non-fatal-to-startup story
-      # as the other optional secrets here.
+      # as the other optional secrets here. P4N_USER/P4N_PASSWORD alone
+      # don't actually work here — park4night's login form is behind
+      # invisible reCAPTCHA, which no browserless login can satisfy — so
+      # P4N_SESSION_COOKIE (a real logged-in browser's session cookie,
+      # copied out by hand and refreshed whenever it expires) is what
+      # p4n2gpx.rb's make_session actually ends up using.
       P4N_USER: ${P4N_USER:-}
       P4N_PASSWORD: ${P4N_PASSWORD:-}
+      P4N_SESSION_COOKIE: ${P4N_SESSION_COOKIE:-}
       # The kiwix service below, reached by its compose service name (both
       # are on the same default compose network) — port matches its own
       # --port=8080 in the command below. Not made conditional on the ZIM