botstopper: Add info about cookies

Users must be aware that they need to review their cookie consent
manager policies to make sure the botstopper cookie is going to be
allowed.

Author: tdgroot

docs/hypernode-platform/botstopper/how-to-use-botstopper.md

@@ -20,6 +20,10 @@ For more background on bot traffic and Magento performance, see [How to Fix Perf
 
 ## Enable Botstopper
 
+```{warning}
+If you run a cookie consent manager in explicit mode, where only required cookies are persisted until the visitor accepts, mark the `hnbotstopper-auth` cookie as required before enabling Botstopper. Otherwise visitors who pass a challenge keep losing the cookie and the site breaks. See [The hnbotstopper-auth Cookie](#the-hnbotstopper-auth-cookie) for details.
+```
+
 Botstopper is disabled by default on a Hypernode. Enable it with:
 
 ```bash
@@ -85,6 +89,14 @@ Botstopper evaluates policy rules from top to bottom. A rule can allow, deny, ch
 
 Challenge responses use HTTP `200`. This is intentional. Many aggressive scraper bots stop retrying once they receive a `200` response.
 
+## The hnbotstopper-auth Cookie
+
+When a visitor passes a browser challenge, Botstopper stores the result in a cookie named `hnbotstopper-auth`. The browser sends this cookie on later requests so the visitor does not have to solve a new challenge every time.
+
+```{warning}
+If you run a cookie consent manager in explicit mode, where only required cookies are persisted until the visitor accepts, you must mark `hnbotstopper-auth` as a required cookie. Otherwise the consent manager strips the cookie, the visitor fails the challenge on every request, and the site breaks.
+```
+
 ## Standard Hypernode Policies
 
 Hypernode ships Botstopper with a standard policy that keeps important services working and blocks common abusive traffic.