feat(browser): unify site credentials with browser profiles (BR-2)

- Inject the site account Cookie (manual + auto-login session, session wins)
  into the camofox profile before the first tab opens; password accounts
  without a session run refresh-login first; API Key sites are skipped.
- Cookie expired after injection -> credential.status=expired; cookie
  accounts go to waiting/login_required ("log in once, applies site-wide").
- Write back site-domain cookies from the browser on handover, session close,
  every 10 min of activity, and from refresh-login when the stored cookie is
  invalid (verified before saving). user_info.cookieOrigin records
  source=browser; source shown as manual/login/browser in the origin view.
- New camofox plugin umt-cookies (GET/POST /umt/sessions/:userId/cookies
  under the access key); profile dir 0700/files 0600 in the desktop image.
- Single entry: sources-identity/service/credentials.ts.
- Real check: HHClub cookie injected into a fresh profile -> home page
  logged in (logout link present), 5 cookies read back.

Requires rebuilding umt-browser-desktop (docker compose build camofox &&
docker compose up -d camofox) to take effect.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/web/scripts/smoke.mjs

@@ -250,6 +250,36 @@ async function main() {
     }
   }
 
+  // ── 交互:Agent 抽屉「历史」Tab(AGUI-2;演示数据,点一条在抽屉内打开、返回列表、关了再开仍停在历史)──
+  {
+    const label = "Agent 抽屉 → 历史 → 抽屉内打开会话";
+    problems = [];
+    const t0 = Date.now();
+    try {
+      await page.goto("about:blank");
+      await page.goto(`${BASE}/console/audit?mock=1`, { waitUntil: "networkidle", timeout: 30_000 });
+      const launcher = page.locator("[data-agent-launcher]:visible").last();
+      await launcher.click();
+      await page.getByRole("tab", { name: "历史" }).click();
+      const list = page.getByRole("navigation", { name: "Agent 会话列表" });
+      await list.getByRole("button").first().click();
+      await page.getByRole("button", { name: "返回列表" }).waitFor({ timeout: 10_000 });
+      if (new URL(page.url()).pathname !== "/console/audit") problems.push("点历史会话跳走了页面");
+      await page.getByRole("button", { name: "返回列表" }).click();
+      await list.waitFor({ timeout: 5_000 });
+      await page.keyboard.press("Escape");
+      await launcher.click();
+      const tab = await page.getByRole("tab", { name: "历史" }).getAttribute("aria-selected");
+      if (tab !== "true") problems.push("再次打开没有停在「历史」");
+      if (SHOTS) await page.screenshot({ path: join(OUT, "agent_drawer_history.png") }).catch(() => {});
+      await page.keyboard.press("Escape");
+      await page.goto(`${BASE}/console/agent?mock=0`, { waitUntil: "networkidle", timeout: 30_000 });
+    } catch (err) {
+      problems.push(`交互失败:${String(err?.message ?? err).split("\n")[0]}`);
+    }
+    results.push({ path: label, ms: Date.now() - t0, problems: [...new Set(problems)] });
+  }
+
   // ── 旧链接重定向 ──
   for (const r of REDIRECT_ROUTES) {
     let from = r.from;