feat(sites): site requests follow browser UA, smooth UA switch, CF cookies browser-only (BR-4)

- every outbound site request (adapter list/search/detail/download/health,
  RSS, login, user data) carries the account UA via SourcesRuntime.siteFetch;
  no more Deno default UA
- priority: account manual > pending > global setting > browser identity
  (fallback: same-shape Windows Firefox UA); settings UA default is empty
- migration 0056: existing cookie/password accounts keep their old UA as
  ua_pending until re-login or browser cookie write-back switches cookie+UA
  in one transaction; browser_provider.identity caches the browser identity
- cf_clearance/__cf_bm stripped on browser write-back (names kept only)
- browser sessions get per-site egress (same proxy as HTTP, or direct)
- site account page shows UA source; raw UA in tech info

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/contracts/test/db-sync.test.ts

@@ -83,8 +83,9 @@ const ROWS: Record<string, { row: Obj; dbOnly?: string[]; apiOnly?: string[] }>
   SiteUserData: { row: C.SiteUserData },
   SiteAccount: {
     row: C.SiteAccount,
-    dbOnly: ["totpSecretRef", "sessionSecretRef", "passkeySecretRef"],
-    apiOnly: ["hasTotp", "hasSession", "hasPasskey"],
+    // BR-4:ua_pending 只给解析后的 userAgentSource / effectiveUserAgent;browserOnlyCookies 取自 user_info
+    dbOnly: ["totpSecretRef", "sessionSecretRef", "passkeySecretRef", "uaPending"],
+    apiOnly: ["hasTotp", "hasSession", "hasPasskey", "userAgentSource", "effectiveUserAgent", "browserOnlyCookies"],
   },
   SourceRelease: { row: C.SourceRelease },
   Subscription: { row: C.Subscription, apiOnly: ["mediaEntityTitle"] },
@@ -100,7 +101,8 @@ const ROWS: Record<string, { row: Obj; dbOnly?: string[]; apiOnly?: string[] }>
   ResolutionAttempt: { row: C.ResolutionAttempt },
   SiteSnapshot: { row: C.SiteSnapshot },
   // W4-C 浏览器实体(0023)
-  BrowserProvider: { row: C.BrowserProviderRow },
+  // BR-4:identity 是浏览器固定身份的缓存(站点请求 UA 用),不进 API
+  BrowserProvider: { row: C.BrowserProviderRow, dbOnly: ["identity"] },
   BrowserSession: { row: C.BrowserSession },
   BrowserTab: { row: C.BrowserTab },
   BrowserControlLease: { row: C.BrowserControlLease },