feat(sites): site requests follow browser UA, smooth UA switch, CF cookies browser-only (BR-4)

- every outbound site request (adapter list/search/detail/download/health,
  RSS, login, user data) carries the account UA via SourcesRuntime.siteFetch;
  no more Deno default UA
- priority: account manual > pending > global setting > browser identity
  (fallback: same-shape Windows Firefox UA); settings UA default is empty
- migration 0056: existing cookie/password accounts keep their old UA as
  ua_pending until re-login or browser cookie write-back switches cookie+UA
  in one transaction; browser_provider.identity caches the browser identity
- cf_clearance/__cf_bm stripped on browser write-back (names kept only)
- browser sessions get per-site egress (same proxy as HTTP, or direct)
- site account page shows UA source; raw UA in tech info

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/web/app/components/settings/sites.tsx

@@ -55,7 +55,8 @@ const DEFAULTS_CARD: CardSpec = {
       name: "sites.userAgent",
       label: "User-Agent",
       kind: "text",
-      hint: "账号没填 UA 时，登录和拉取用户数据用这个",
+      placeholder: "跟随浏览器",
+      hint: "留空跟随浏览器（推荐），站点请求和浏览器用同一个 UA。填了则账号没单独填 UA 时都用它，和浏览器不一致",
       wide: true,
     },
     {
@@ -96,7 +97,8 @@ const DEFAULTS_CARD: CardSpec = {
         defaultSnapshotMaxPages: num(v["sites.defaultSnapshotMaxPages"]),
         defaultHealthCheckIntervalSec: healthH === undefined ? undefined : Math.round(healthH * 3600),
         defaultDetailCacheSec: detailH === undefined ? undefined : Math.round(detailH * 3600),
-        userAgent: str(v["sites.userAgent"]) || undefined,
+        // 空串 = 跟随浏览器(要能清空,不能用 undefined 表示"不改")
+        userAgent: str(v["sites.userAgent"]),
         proxyUrl: str(v["sites.proxyUrl"]) || null,
       },
     };