fix: allow verify_cf() to click turnstile checkbox

[A-Nolan]

Description

Fixes #270

verify_cf() silently no-ops on some Turnstile checkbox challenges: it correctly finds and measures the challenge iframe, but never actually clicks it. On real-world Turnstile markup, the hidden cf-turnstile-response/cf_challenge_response <input> that verify_cf() uses to detect "has the checkbox already been solved" is rendered as a document-level sibling of the challenge's shadow-DOM host, not nested inside it. The lookup was scoped to host_element.query_selector(...), which always came back empty in that case, so the function hit if not input_element: return and exited before ever reaching the click loop

Fixes this by querying the input from tab (the whole document) instead of host_element, at both call sites (the initial lookup and the completion check inside check_input()). Verified live against cardmarket.com: the checkbox is now clicked and the challenge clears.

Pre-merge Checklist

• I have described my change in the section above.
• I have ran the ./scripts/format.sh and ./scripts/lint.sh scripts. My code is properly formatted and has no linting errors.
• I have ran uv run pytest and ensured all tests pass.
• I have added my change to CHANGELOG.md under the [Unreleased] section.