feat(browser): unify site credentials with browser profiles (BR-2)

- Inject the site account Cookie (manual + auto-login session, session wins)
  into the camofox profile before the first tab opens; password accounts
  without a session run refresh-login first; API Key sites are skipped.
- Cookie expired after injection -> credential.status=expired; cookie
  accounts go to waiting/login_required ("log in once, applies site-wide").
- Write back site-domain cookies from the browser on handover, session close,
  every 10 min of activity, and from refresh-login when the stored cookie is
  invalid (verified before saving). user_info.cookieOrigin records
  source=browser; source shown as manual/login/browser in the origin view.
- New camofox plugin umt-cookies (GET/POST /umt/sessions/:userId/cookies
  under the access key); profile dir 0700/files 0600 in the desktop image.
- Single entry: sources-identity/service/credentials.ts.
- Real check: HHClub cookie injected into a fresh profile -> home page
  logged in (logout link present), 5 cookies read back.

Requires rebuilding umt-browser-desktop (docker compose build camofox &&
docker compose up -d camofox) to take effect.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/web/app/api/agent.ts

@@ -13,6 +13,7 @@ import {
   type AgentRunEvent,
   type AgentRunMessage,
   type AgentRunStatus,
+  type AgentTrigger,
   Approval,
   type ApprovalStatus,
   AuditEvent,
@@ -119,21 +120,38 @@ function useAgentMockGate(): boolean {
 
 export const agentKeys = {
   all: ["agent"] as const,
-  runs: (status?: AgentRunStatus) => ["agent", "list", status ?? "all"] as const,
+  runs: (status?: AgentRunStatus, trigger?: AgentTrigger) =>
+    ["agent", "list", status ?? "all", trigger ?? "any"] as const,
   run: (id: string) => ["agent", "detail", id] as const,
 };
 
 const RUNNING: AgentRunStatus[] = ["queued", "running", "waiting"];
 export const isRunActive = (s: AgentRunStatus | undefined) => !!s && RUNNING.includes(s);
 
-export function useAgentRuns(status?: AgentRunStatus) {
+/** 会话来源(run.trigger)的界面名:手动 / 巡检 / 事件 / 子会话 */
+export const TRIGGER_LABEL: Record<AgentTrigger, string> = {
+  user: "手动",
+  schedule: "巡检",
+  event: "事件",
+  subagent: "子会话",
+};
+
+/** 会话列表:按状态、来源(trigger)在服务端筛选,游标翻页 */
+export function useAgentRuns(status?: AgentRunStatus, trigger?: AgentTrigger) {
   const mock = useAgentMockGate();
   return useInfiniteQuery({
-    queryKey: [...agentKeys.runs(status), mock],
+    queryKey: [...agentKeys.runs(status, trigger), mock],
     initialPageParam: undefined as string | undefined,
     queryFn: async ({ pageParam, signal }) => {
-      if (mock) return { items: MOCK_RUNS().filter((r) => !status || r.status === status), nextCursor: null };
-      return apiParsed(RunPage, AGENT_BASE, { params: cleanParams({ status, cursor: pageParam, limit: 30 }), signal });
+      if (mock)
+        return {
+          items: MOCK_RUNS().filter((r) => (!status || r.status === status) && (!trigger || r.trigger === trigger)),
+          nextCursor: null,
+        };
+      return apiParsed(RunPage, AGENT_BASE, {
+        params: cleanParams({ status, trigger, cursor: pageParam, limit: 30 }),
+        signal,
+      });
     },
     getNextPageParam: (last) => last.nextCursor ?? undefined,
     refetchInterval: (q) =>