feat(curogram): CDP helper to activate a member account from an email invite

setup_account_from_invite.py drives the AGENT Chrome over CDP to complete the
Curogram "Set a password" onboarding flow end-to-end.

Handles the two non-obvious failure modes encountered in practice:
- Mandrill click-tracker mangles the change-password token in the visible anchor
  href (extra hex digit -> API rejects "PasswordChangeToken must be CHPWD-prefexed
  UUID"). decode_mandrill_url() recovers the canonical token from the base64 p=
  payload.
- Angular reactive-form validators ignore values set via the native value setter
  (and can leave duplicated text -> length mismatch). Real CDP keystrokes
  (Input.insertText) + blur are used instead.

No secrets, tokens, or PHI: the password is read at runtime from the 0600 creds
env (CUROGRAM_AGENT_PASSWORD); only field lengths and API status codes are
emitted; the patient-listing dashboard body is never dumped.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>