costco-watch: client-side browser headers, drop Transform Rule requirement

apps/costco-watch/build/README.md

@@ -5,9 +5,12 @@ Source: https://git.alexzaw.dev/alexz/costco-watch (working copy:
 ~/projects/costco-watch). Build + push with ./build.sh.
 
 Gotchas:
-- TARGET_URL must go through the costco-tire cloudflared proxy AND that
-  hostname needs a Cloudflare Transform Rule adding browser headers
-  (User-Agent, Accept, Accept-Language, Sec-Fetch-*). Without it Costco stalls
-  the request until timeout and the checker reports "error"/"blocked".
+- Costco stalls (no response, just a hang) on requests lacking Sec-Fetch-*
+  headers. watch.js sends a browser header set in BROWSER_HEADERS - do not
+  strip it. Any single Sec-Fetch-* header is sufficient; UA/Accept alone are
+  not. Cloudflare Transform Rules CANNOT substitute for this: Sec-* headers are
+  on Cloudflare's restricted list, and cloudflared can't add headers at all.
+- TARGET_URL goes through the costco-tire cloudflared ingress, which sets
+  httpHostHeader: tires.costco.com.
 - State (last stock value, transition history) lives in ${APP_DATA_DIR}/data;
   wiping it means the next check can re-alert.