fix(sites): HHClub parsing, resource list layout and request restraint

HHClub (憨憨) was checked read-only against a real account (one detail
request; list, user data and health came from the product's own fetch).

Parsing fixes:
- list titles carried the site's new-torrent marker "[新]" (58 of 100
  rows; the detail page title has none); stripped with a replace filter
- refreshing a detail overwrote seeders / leechers / snatched / category
  name / H&R with null because the HHClub div detail page lacks them;
  detail values now fall back to the list snapshot (mergeDetailOverList),
  and an unknown detail promotion keeps the list promotion
- level "贵宾" is VIP (umt.vipLevels)
- sanitized minimal fixture HHANCLUB_LIST_PAGE_2026 + tests; README marks
  HHClub as verified 2026-09-29
Size, counts, category ids/names, +08:00 time and subtitle were correct.

Request restraint:
- site definitions may carry umt.defaults; merged with settings.sites
  (longer intervals, fewer pages): new settings defaultSnapshotMaxPages 1,
  defaultHealthCheckIntervalSec 6 h, defaultDetailCacheSec 24 h; default
  burst 2. HHClub: snapshot 60 min page 1 only, health 6 h, search
  concurrency 1, detail cache 24 h, 1 token / 3 s burst 2
- periodic / manual snapshots are capped to that page count; scheduled
  health checks skip sites checked within the interval; detail refresh is
  served from cache inside the window; live searches on one site queue
- every rate-limiter token is counted per site per hour
  (site_request_count, migration 0046); GET /sites/{id}/request-stats;
  site overview and resource list show requests in the last 24 hours

Resource list: two-layer rows. Main line: title + spec tags (episodes,
resolution, source, codec, HDR, group, 国语/中字, site tags) + promotion
with time left + H&R. Second line: subtitle (one line, ellipsis) and
fixed-width category / size / seed-leech-snatched / upload time
(relative, absolute on hover) columns, stale badge, inventory overlay;
folds into a card on phones.

Also aligns identity_candidate.normalized_title order in db types with
the migrations (schema drift test).

Takes effect after the stack is rebuilt (migration 0046).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/web/app/routes/console/agent.tsx

@@ -1,4 +1,6 @@
+import type { AgentRunStatus } from "@umt/contracts";
 import { FlaskConical, ShieldCheck } from "lucide-react";
+import { useState } from "react";
 import { useNavigate } from "react-router";
 import { toast } from "sonner";
 import { agentMockEnabled, useCreateAgentRun } from "~/api/agent.ts";
@@ -9,6 +11,7 @@ import { Button } from "~/components/ui/button.tsx";
 import { errorMessage } from "~/lib/api.ts";
 
 export default function AgentPage() {
+  const [status, setStatus] = useState<"" | AgentRunStatus>("");
   const create = useCreateAgentRun();
   const navigate = useNavigate();
   const mock = agentMockEnabled();
@@ -28,11 +31,11 @@ export default function AgentPage() {
           </Button>
         </div>
       ) : null}
-      <div className="grid grid-cols-1 gap-4 lg:grid-cols-[minmax(0,20rem)_minmax(0,1fr)] lg:items-start">
-        <div className="pg-slab order-2 rounded-xl p-3 lg:order-1 lg:h-[calc(100dvh-12rem)] lg:overflow-hidden">
-          <AgentSessionList hrefFor={(id) => `/console/agent/${id}${mock ? "?mock=1" : ""}`} className="h-full" />
+      <div className="grid grid-cols-1 gap-4 lg:grid-cols-[minmax(0,20rem)_minmax(0,1fr)]">
+        <div className="pg-slab order-2 rounded-xl p-3 lg:order-1 lg:max-h-[calc(100dvh-12rem)] lg:overflow-hidden">
+          <AgentSessionList status={status} onStatusChange={setStatus} className="h-full" />
         </div>
-        <div className="order-1 mx-auto w-full max-w-[88ch] space-y-3 lg:order-2">
+        <div className="order-1 space-y-4 lg:order-2">
           <div className="pg-slab rounded-xl p-4">
             <h2 className="mb-3 text-body font-medium text-foreground">新会话</h2>
             <GoalComposer
@@ -48,10 +51,15 @@ export default function AgentPage() {
               }
             />
           </div>
-          <p className="flex items-center gap-2 px-1 text-meta text-muted-foreground">
-            <ShieldCheck aria-hidden className="size-3.5 shrink-0" />
-            每次工具调用都经服务端授权校验，汇报以系统核实的结果为准。
-          </p>
+          <div className="flex gap-3 rounded-xl border border-border/70 p-4 text-caption text-muted-foreground">
+            <ShieldCheck aria-hidden className="mt-0.5 size-4 shrink-0" />
+            <div className="space-y-1">
+              <p>
+                每次工具调用都经服务端授权校验。控制台发起的会话里，没有持续授权的下载、整理、策略发布会在对应步骤出审批卡。
+              </p>
+              <p>汇报分两栏：模型自述仅供参考，"系统核实的结果"取自下载计划、下载任务和整理记录。</p>
+            </div>
+          </div>
         </div>
       </div>
     </>