fix(sites): integrate shared download access and register synced adapters

apps/server/test/site-fetch-credentials.test.ts

@@ -0,0 +1,22 @@
+import { expect, it, vi } from "vitest";
+import { SourcesRuntime } from "../src/modules/sources-identity/runtime.ts";
+
+it("签名下载的 credentials omit 不复用账号或浏览器Cookie", async () => {
+  let sent = new Headers();
+  const rt = new SourcesRuntime({} as never, {
+    fetch: async (_input, init) => {
+      sent = new Headers(init?.headers);
+      return new Response("subtitle bytes");
+    },
+  });
+  const browser = vi.spyOn(rt.cloudflare, "handle");
+  const fetch = rt.siteFetch({ id: "original-site", proxy: false }, undefined, "Site User Agent");
+  const headers = { cookie: "account-cookie", authorization: "account-token" };
+  const url = "https://signed-cdn.example/file?credential=ephemeral";
+  const response = await fetch(url, { headers, credentials: "omit" });
+  expect(await response.text()).toBe("subtitle bytes");
+  expect(sent.has("cookie")).toBe(false);
+  expect(sent.has("authorization")).toBe(false);
+  expect(sent.get("user-agent")).toBe("Site User Agent");
+  expect(browser).not.toHaveBeenCalled();
+});