feat(browser): unify site credentials with browser profiles (BR-2)

- Inject the site account Cookie (manual + auto-login session, session wins)
  into the camofox profile before the first tab opens; password accounts
  without a session run refresh-login first; API Key sites are skipped.
- Cookie expired after injection -> credential.status=expired; cookie
  accounts go to waiting/login_required ("log in once, applies site-wide").
- Write back site-domain cookies from the browser on handover, session close,
  every 10 min of activity, and from refresh-login when the stored cookie is
  invalid (verified before saving). user_info.cookieOrigin records
  source=browser; source shown as manual/login/browser in the origin view.
- New camofox plugin umt-cookies (GET/POST /umt/sessions/:userId/cookies
  under the access key); profile dir 0700/files 0600 in the desktop image.
- Single entry: sources-identity/service/credentials.ts.
- Real check: HHClub cookie injected into a fresh profile -> home page
  logged in (logout link present), 5 cookies read back.

Requires rebuilding umt-browser-desktop (docker compose build camofox &&
docker compose up -d camofox) to take effect.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/web/app/components/browser/desktop-view.tsx

@@ -9,7 +9,7 @@ import { StatusBadge, type StatusTone } from "~/components/console/status-badge.
 import { Button } from "~/components/ui/button.tsx";
 import { apiData, errorMessage } from "~/lib/api.ts";
 import { qk } from "~/lib/query-keys.ts";
-import { CONTROLLER_LABEL, holderName, waitingText } from "./coords.ts";
+import { CONTROLLER_LABEL, credentialBadge, holderName, waitingText } from "./coords.ts";
 import { SiteOriginView } from "./site-origin-view.tsx";
 
 // 原站视图桌面模式(docs/design/webtop-remote-browser.md §5.7):iframe 嵌浏览器桌面(Selkies),
@@ -115,6 +115,7 @@ function DesktopView({
   const mine = role === "controller";
   const busy = control.acquire.isPending || control.release.isPending;
   const waiting = waitingText(s.waitingReason);
+  const cred = credentialBadge(s.credential);
   const leaseHolder = s.lease ? holderName(s.lease.holder) : null;
   const conn: { tone: StatusTone; text: string } = loaded
     ? mine
@@ -131,6 +132,11 @@ function DesktopView({
           {human && leaseHolder ? `(${leaseHolder})` : ""}
         </StatusBadge>
         {waiting ? <StatusBadge tone="warning">{waiting}</StatusBadge> : null}
+        {cred ? (
+          <span title={cred.title}>
+            <StatusBadge tone={cred.tone}>{cred.text}</StatusBadge>
+          </span>
+        ) : null}
         <div className="ml-auto flex flex-wrap items-center gap-2">
           {human && mine ? (
             <Button