Filter browser-extension cookies from detection

Cookies set by browser extensions are not the website operator's
compliance responsibility. This adds stack-trace inspection to
filter out extension-originated document.cookie writes, and
annotates pre-existing cookies with a source field so operators
can triage them separately.

Introduces a CookieSource enum (SCRIPT / PRE_EXISTING) across
the full stack: PostgreSQL, coredata, service, HTTP handler, and
GraphQL schema. On conflict, source is upgraded from PRE_EXISTING
to SCRIPT when a page script is later observed setting the cookie.

Signed-off-by: Émile Ré <emile@getprobo.com>

pkg/server/api/console/v1/graphql/cookie_banner.graphql

@@ -22,6 +22,18 @@ enum CookieConsentMode
         )
 }
 
+enum CookieSource
+    @goModel(model: "go.probo.inc/probo/pkg/coredata.CookieSource") {
+    SCRIPT
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.CookieSourceScript"
+        )
+    PRE_EXISTING
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.CookieSourcePreExisting"
+        )
+}
+
 enum CookieBannerOrderField
     @goModel(
         model: "go.probo.inc/probo/pkg/coredata.CookieBannerOrderField"
@@ -174,6 +186,7 @@ type Cookie implements Node {
     name: String!
     duration: String!
     description: String!
+    source: CookieSource!
     createdAt: Datetime!
     updatedAt: Datetime!
 

pkg/server/api/console/v1/types/cookie.go

@@ -72,6 +72,7 @@ func NewCookie(c *coredata.Cookie) *Cookie {
 		Name:        c.Name,
 		Duration:    c.Duration,
 		Description: c.Description,
+		Source:      c.Source,
 		CreatedAt:   c.CreatedAt,
 		UpdatedAt:   c.UpdatedAt,
 	}

pkg/server/api/cookiebanner/v1/handler.go

@@ -189,6 +189,7 @@ func (h *Handler) handlePostConsent(w http.ResponseWriter, r *http.Request) {
 type detectedCookieEntry struct {
 	Name     string `json:"name"`
 	Duration string `json:"duration"`
+	Source   string `json:"source"`
 }
 
 type reportDetectedCookiesBody struct {
@@ -227,11 +228,20 @@ func (h *Handler) handleReportDetectedCookies(w http.ResponseWriter, r *http.Req
 			continue
 		}
 
+		var source coredata.CookieSource
+		switch strings.TrimSpace(c.Source) {
+		case "pre-existing":
+			source = coredata.CookieSourcePreExisting
+		default:
+			source = coredata.CookieSourceScript
+		}
+
 		detected = append(
 			detected,
 			cookiebanner.DetectedCookie{
 				Name:     name,
 				Duration: strings.TrimSpace(c.Duration),
+				Source:   source,
 			},
 		)
 	}