fix(settings): Bugcrowd hint points to session cookie, not API Credentials

Correcting the previous hint: Bugcrowd's 'API Credentials' (id:secret) are for
their REST API and are NOT usable by this integration, which authenticates via
the _crowdcontrol_session_key session cookie only (bbscope sends just that
cookie). Point users to copy that cookie value from their logged-in browser.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: h0tak88r

internal/api/ui/pages/settings.js

@@ -179,7 +179,7 @@
                 </div>
               </div>
             </div>
-            ${tokenRow('Bugcrowd', 'Your Bugcrowd API token (format <code>id:secret</code>) — or the <code>_crowdcontrol_session_key</code> session-cookie value. Paste either; both are sent the same way.', 'bc-token-input', 'window.SettingsPage.saveBugcrowdToken()', 'id:secret token', cfg.bc_token_set)}
+            ${tokenRow('Bugcrowd', 'The value of your <code>_crowdcontrol_session_key</code> cookie — from your logged-in browser (bugcrowd.com → DevTools → Application/Storage → Cookies). This is the session cookie, <em>not</em> the "API Credentials" token, which this integration can\'t use.', 'bc-token-input', 'window.SettingsPage.saveBugcrowdToken()', '_crowdcontrol_session_key value', cfg.bc_token_set)}
             ${tokenRow('Intigriti', 'Researcher API token.', 'it-token-input', 'window.SettingsPage.saveIntigritiToken()', 'API token', cfg.it_token_set)}
             ${tokenRow('YesWeHack', 'JWT token.', 'ywh-token-input', 'window.SettingsPage.saveYWHToken()', 'JWT token', cfg.ywh_token_set)}
             <div class="settings-item">