docs: lectia despre env-ul mostenit care bate .env la schimbarea parolei

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YbuWZ699EFeYfPA3nNraa9

CLAUDE.md

@@ -23,6 +23,17 @@ BTGO Scraper - Playwright automation for extracting account balances and transac
   for speed would be running outside Session 0, with a GPU.
 - **No fixed `time.sleep()` for page state**: on the slow prod machine, hardcoded
   waits time out. Always wait on a selector/condition (`wait_for_selector`), generously.
+- **Stale env beats `.env`**: the scraper is spawned by `telegram_trigger_bot.py`
+  with `env=os.environ.copy()`, and the bot loaded `.env` at *its* startup. Since
+  `load_dotenv()` never overrides an existing env var, a password changed in `.env`
+  was ignored until the bot restarted -> BT rejected the login, no 2FA push was sent,
+  and the run died with a misleading "Timeout 2FA". Credentials are now read straight
+  from the `.env` file (`dotenv_values()` in `config.py`); everything else still comes
+  from the environment so the bot can pass `TELEGRAM_MESSAGE_ID` / `SEND_AS_ZIP` per run.
+- **A rejected login looks exactly like an unapproved 2FA**: always check the login
+  page for an error message while polling for `#accountsBtn`
+  (`_detect_login_error`), otherwise every credential problem costs a full
+  `TIMEOUT_2FA_SECONDS` and reports the wrong cause.
 - **`networkidle` never fires**: BT pages poll trackers continuously. Use
   `domcontentloaded` + explicit selector waits.