feat(sites): site requests follow browser UA, smooth UA switch, CF cookies browser-only (BR-4)

- every outbound site request (adapter list/search/detail/download/health,
  RSS, login, user data) carries the account UA via SourcesRuntime.siteFetch;
  no more Deno default UA
- priority: account manual > pending > global setting > browser identity
  (fallback: same-shape Windows Firefox UA); settings UA default is empty
- migration 0056: existing cookie/password accounts keep their old UA as
  ua_pending until re-login or browser cookie write-back switches cookie+UA
  in one transaction; browser_provider.identity caches the browser identity
- cf_clearance/__cf_bm stripped on browser write-back (names kept only)
- browser sessions get per-site egress (same proxy as HTTP, or direct)
- site account page shows UA source; raw UA in tech info

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/web/app/components/sites/credential-fields.tsx

@@ -234,10 +234,15 @@ export function CredentialFields({
         <FormField
           label="User-Agent"
           htmlFor={id("ua")}
-          hint={value.kind === "cookie" ? "Cookie 与浏览器 UA 绑定时填写；留空用站点默认" : "留空用站点默认"}
+          hint={
+            value.kind === "cookie"
+              ? "留空跟随浏览器（推荐）。Cookie 是从别的浏览器复制的、且站点校验 UA 时，填那个浏览器的 UA"
+              : "留空跟随浏览器（推荐）"
+          }
         >
           <Input
             id={id("ua")}
+            placeholder="跟随浏览器"
             value={value.userAgent}
             onChange={(e) => set("userAgent", e.target.value)}
             disabled={disabled}