feat(browser): unify site credentials with browser profiles (BR-2)

- Inject the site account Cookie (manual + auto-login session, session wins)
  into the camofox profile before the first tab opens; password accounts
  without a session run refresh-login first; API Key sites are skipped.
- Cookie expired after injection -> credential.status=expired; cookie
  accounts go to waiting/login_required ("log in once, applies site-wide").
- Write back site-domain cookies from the browser on handover, session close,
  every 10 min of activity, and from refresh-login when the stored cookie is
  invalid (verified before saving). user_info.cookieOrigin records
  source=browser; source shown as manual/login/browser in the origin view.
- New camofox plugin umt-cookies (GET/POST /umt/sessions/:userId/cookies
  under the access key); profile dir 0700/files 0600 in the desktop image.
- Single entry: sources-identity/service/credentials.ts.
- Real check: HHClub cookie injected into a fresh profile -> home page
  logged in (logout link present), 5 cookies read back.

Requires rebuilding umt-browser-desktop (docker compose build camofox &&
docker compose up -d camofox) to take effect.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/init-umt-desktop/run

@@ -27,4 +27,6 @@ chmod 550 "$LABWC_DIR/autostart"
 PROFILE_ROOT="$(dirname "${CAMOFOX_PROFILE_DIR:-/root/.camofox/profiles}")"
 mkdir -p "${CAMOFOX_PROFILE_DIR:-/root/.camofox/profiles}"
 chown -R abc:abc "$PROFILE_ROOT"
+# 登录状态含站点 Cookie:目录 0700、文件 0600(旧镜像落盘的是 0644)
+chmod -R go-rwx "$PROFILE_ROOT"
 chmod 711 /root

docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/svc-camofox/run

@@ -12,6 +12,8 @@ if [[ "${UMT_DESKTOP_IME,,}" == "fcitx5" ]]; then
 fi
 # Selkies 的手柄/摄像头 LD_PRELOAD 不给浏览器
 unset LD_PRELOAD
+# profile 落盘文件(storage-state.json 含登录 Cookie)只给运行用户读写
+umask 077
 cd /opt/camofox
 # exec:SIGTERM 直达 node,持久化插件关机落盘(docker/camofox/Dockerfile 同样的教训)
 exec s6-setuidgid abc node --max-old-space-size="${MAX_OLD_SPACE_SIZE:-128}" server.js