feat(sites): site requests follow browser UA, smooth UA switch, CF cookies browser-only (BR-4)

- every outbound site request (adapter list/search/detail/download/health,
  RSS, login, user data) carries the account UA via SourcesRuntime.siteFetch;
  no more Deno default UA
- priority: account manual > pending > global setting > browser identity
  (fallback: same-shape Windows Firefox UA); settings UA default is empty
- migration 0056: existing cookie/password accounts keep their old UA as
  ua_pending until re-login or browser cookie write-back switches cookie+UA
  in one transaction; browser_provider.identity caches the browser identity
- cf_clearance/__cf_bm stripped on browser write-back (names kept only)
- browser sessions get per-site egress (same proxy as HTTP, or direct)
- site account page shows UA source; raw UA in tech info

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/contracts/src/sources.ts

@@ -252,8 +252,17 @@ export const SiteAccount = EntityBase.extend({
   userInfo: JsonObject,
   /** 账密登录名 */
   loginName: z.string().nullable(),
-  /** 空 = 全局默认 UA(settings.sites.userAgent) */
+  /** 账号手动填的 UA;空 = 不覆盖(见 userAgentSource / effectiveUserAgent) */
   userAgent: z.string().nullable(),
+  /**
+   * 当前生效 UA 的来源(BR-4):browser = 跟随浏览器;manual = 账号手动填写;global = 设置里的全局 UA;
+   * pending = 待切换(沿用取得当前 Cookie 时的旧 UA,下次重新登录或浏览器回写 Cookie 时换成浏览器 UA)
+   */
+  userAgentSource: z.enum(["browser", "manual", "global", "pending"]),
+  /** 当前站点请求实际发送的 UA(技术信息) */
+  effectiveUserAgent: z.string(),
+  /** 仅浏览器用、没有回写给站点请求的 Cookie 名(Cloudflare 验证 Cookie,不含值) */
+  browserOnlyCookies: z.array(z.string()),
   /** 最近一次登录 / 校验成功(Cookie、API Key 校验成功也算) */
   lastLoginAt: Timestamp.nullable(),
   lastError: SiteAccountError.nullable(),