fix: CSV import drops contact_email; add incognito browser launch to dev_run.sh

- outreach_import(): contact_email was extracted + used for dedup but
  missing from the INSERT — added it to the column list and values tuple
- test_import_creates_prospects: strengthen to assert contact_email is
  actually persisted (regression test for the above bug)
- dev_run.sh: after server ready, open incognito/private browser window
  at dev-login URL; tries google-chrome → chromium → firefox in order

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

web/tests/test_outreach.py

@@ -393,11 +393,14 @@ class TestCSVImport:
         assert resp.status_code == 302
 
         rows = await core.fetch_all(
-            "SELECT name, outreach_status FROM suppliers WHERE outreach_status = 'prospect'"
+            "SELECT name, contact_email, outreach_status FROM suppliers WHERE outreach_status = 'prospect'"
         )
-        names = {r["name"] for r in rows}
-        assert "BuildCo" in names
-        assert "CourtTech" in names
+        by_name = {r["name"]: r for r in rows}
+        assert "BuildCo" in by_name
+        assert "CourtTech" in by_name
+        # contact_email must be persisted (regression: was silently dropped)
+        assert by_name["BuildCo"]["contact_email"] == "build@example.com"
+        assert by_name["CourtTech"]["contact_email"] == "court@example.com"
 
     async def test_import_deduplicates_by_email(self, admin_client, db):
         await _insert_supplier(db, name="Existing", contact_email="dupe@example.com", outreach_status=None)