fix(settings): clarify Bugcrowd credential is an id:secret token

The hint said only '_crowdcontrol_session_key session cookie', which sent
users hunting for a browser cookie. Bugcrowd issues an id:secret API token
that the tool accepts directly (bbscope sends it as the session-cookie
value; verified 200 + programs). Say 'API token (id:secret) — or the
session-cookie value; paste either'.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: h0tak88r

internal/api/ui/pages/settings.js

@@ -179,7 +179,7 @@
                 </div>
               </div>
             </div>
-            ${tokenRow('Bugcrowd', 'Value of the <code>_crowdcontrol_session_key</code> session cookie.', 'bc-token-input', 'window.SettingsPage.saveBugcrowdToken()', 'session cookie value', cfg.bc_token_set)}
+            ${tokenRow('Bugcrowd', 'Your Bugcrowd API token (format <code>id:secret</code>) — or the <code>_crowdcontrol_session_key</code> session-cookie value. Paste either; both are sent the same way.', 'bc-token-input', 'window.SettingsPage.saveBugcrowdToken()', 'id:secret token', cfg.bc_token_set)}
             ${tokenRow('Intigriti', 'Researcher API token.', 'it-token-input', 'window.SettingsPage.saveIntigritiToken()', 'API token', cfg.it_token_set)}
             ${tokenRow('YesWeHack', 'JWT token.', 'ywh-token-input', 'window.SettingsPage.saveYWHToken()', 'JWT token', cfg.ywh_token_set)}
             <div class="settings-item">