feat(browser): unify site credentials with browser profiles (BR-2)

- Inject the site account Cookie (manual + auto-login session, session wins)
  into the camofox profile before the first tab opens; password accounts
  without a session run refresh-login first; API Key sites are skipped.
- Cookie expired after injection -> credential.status=expired; cookie
  accounts go to waiting/login_required ("log in once, applies site-wide").
- Write back site-domain cookies from the browser on handover, session close,
  every 10 min of activity, and from refresh-login when the stored cookie is
  invalid (verified before saving). user_info.cookieOrigin records
  source=browser; source shown as manual/login/browser in the origin view.
- New camofox plugin umt-cookies (GET/POST /umt/sessions/:userId/cookies
  under the access key); profile dir 0700/files 0600 in the desktop image.
- Single entry: sources-identity/service/credentials.ts.
- Real check: HHClub cookie injected into a fresh profile -> home page
  logged in (logout link present), 5 cookies read back.

Requires rebuilding umt-browser-desktop (docker compose build camofox &&
docker compose up -d camofox) to take effect.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/web/app/components/agent/mock.ts

@@ -245,7 +245,15 @@ function seed() {
   const now = Date.now();
   add("把 沙丘：第二部 的 4K 收进来", { proposeFirst: false }, now - 3_600_000, 1);
   add("对比一下 奥本海默 现有版本和站点上的 4K", { proposeFirst: true }, now - 7_200_000, 2);
-  const failed = add("检查 qb-main 为什么占满磁盘", { proposeFirst: false }, now - 86_400_000, 3);
+  const failed = add("巡检：检查 qb-main 为什么占满磁盘", { proposeFirst: false }, now - 86_400_000, 3);
+  failed.run = { ...failed.run, trigger: "schedule" };
+  const evt = add(
+    "新资源到达：看看 奥本海默 的 REMUX 是否值得替换现有版本",
+    { proposeFirst: false },
+    now - 3 * 86_400_000,
+    4,
+  );
+  evt.run = { ...evt.run, trigger: "event" };
   failed.steps = [
     { delayMs: 0, body: { type: "run_started", goal: failed.run.goal, resumed: false } },
     {