docs: correct the xfail reason with what was actually measured

The reason said Cloudflare refuses the checkbox click from datacenter IPs
and that the visitor's address was being judged rather than our code. That
is false. Measured from one datacenter IP within a single hour, byparr
v2.1.0 clears ext.to in 18s, speed.cd/login in 20s and extratorrent.st in
19s, each returning cf_clearance, while no configuration of the current
stack clears any of them.

Two candidate causes were measured and eliminated rather than assumed. The
JS-visible fingerprint is not it: camoufox is the less coherent of the two
browsers -- no WebGL at all, oscpu leaking Linux beneath a Windows UA -- and
passes regardless. The TLS handshake is not it either: re-enabling cipher
0xC009 reproduces camoufox's JA4 byte for byte
(t13d1717h2_5b57614c22b0_3cbfd9057e0d) and the challenge is still refused.

Also records that devtools.jsonview.enabled is load-bearing for #394, and
that the COOP/COEP pair changed no outcome on any site or network measured.

No behaviour change; comments and the xfail reason only.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TDMac4vGGcBhoUB5V6bvFK

src/utils.py

@@ -46,13 +46,15 @@ if len(logger.handlers) == 0:
 # v2.1.0 did via camoufox's disable_coop=True) restores that access, and the
 # solver then clicks the checkbox successfully.
 #
-# It is not a demonstrated win: from a datacenter IP Cloudflare rejects the
-# click regardless -- measured across eight sites, nine clicks, and an
-# undetectable shadow-root patch -- so no outcome changed here. It is kept for
-# parity with v2, which users report worked on these sites, because reaching
-# the checkbox is a precondition for ever passing an interactive challenge and
-# Byparr mostly runs from residential addresses that Cloudflare treats far
-# better than CI does.
+# The COOP/COEP pair is not a demonstrated win: toggling it changed no outcome
+# on any site measured, from either a datacenter or a residential address. It is
+# kept for parity with v2.1.0, which clears the interactive challenge where this
+# stack does not, because reaching the checkbox is a precondition for ever
+# passing one.
+#
+# devtools.jsonview.enabled is load-bearing and must stay. Firefox renders
+# application/json in a viewer whose CSP blocks eval, so page.evaluate() dies
+# with "call to eval() blocked by CSP" and /v1 500s on every JSON API (#394).
 BROWSER_PREFS = {
     "devtools.jsonview.enabled": False,
     "browser.tabs.remote.useCrossOriginOpenerPolicy": False,