How do I allow this site to set the 'user' cookie, but not the '_cfuid' one? Since Cloudflare is proxying, both cookies are first-party.

FF61 on Mac. Solutions for Chrome would also be interesting.

Note that I specifically don't want 'self destructing cookies' or session- or time-limited ones. I just want to white/blacklist by site, cookie name, and perhaps cookie content.

I've briefly looked for suitable extensions, but not yet found anything.

They can't. It may be technically possible, but users can't. Even for power users it's a pain in the ass.