fix: CSV import drops contact_email; add incognito browser launch to dev_run.sh

- outreach_import(): contact_email was extracted + used for dedup but
  missing from the INSERT — added it to the column list and values tuple
- test_import_creates_prospects: strengthen to assert contact_email is
  actually persisted (regression test for the above bug)
- dev_run.sh: after server ready, open incognito/private browser window
  at dev-login URL; tries google-chrome → chromium → firefox in order

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

web/scripts/dev_run.sh

@@ -169,4 +169,25 @@ run_with_label "$COLOR_APP"    "app   " uv run granian --interface asgi --host 1
 run_with_label "$COLOR_WORKER" "worker" uv run python -u -m padelnomics.worker
 run_with_label "$COLOR_CSS"    "css   " make css-watch
 
+# Open a private/incognito browser window once the server is ready.
+# Polls /auth/dev-login until it responds, then launches the browser.
+(
+    DEV_URL="http://localhost:5000/auth/dev-login?email=dev@localhost"
+    for i in $(seq 1 20); do
+        sleep 0.5
+        if curl -s -o /dev/null -w "%{http_code}" "$DEV_URL" 2>/dev/null | grep -qE "^[23]"; then
+            break
+        fi
+    done
+    if command -v google-chrome >/dev/null 2>&1; then
+        google-chrome --incognito "$DEV_URL" &>/dev/null &
+    elif command -v chromium >/dev/null 2>&1; then
+        chromium --incognito "$DEV_URL" &>/dev/null &
+    elif command -v chromium-browser >/dev/null 2>&1; then
+        chromium-browser --incognito "$DEV_URL" &>/dev/null &
+    elif command -v firefox >/dev/null 2>&1; then
+        firefox --private-window "$DEV_URL" &>/dev/null &
+    fi
+) &
+
 wait