feat(sites): site requests follow browser UA, smooth UA switch, CF cookies browser-only (BR-4)

- every outbound site request (adapter list/search/detail/download/health,
  RSS, login, user data) carries the account UA via SourcesRuntime.siteFetch;
  no more Deno default UA
- priority: account manual > pending > global setting > browser identity
  (fallback: same-shape Windows Firefox UA); settings UA default is empty
- migration 0056: existing cookie/password accounts keep their old UA as
  ua_pending until re-login or browser cookie write-back switches cookie+UA
  in one transaction; browser_provider.identity caches the browser identity
- cf_clearance/__cf_bm stripped on browser write-back (names kept only)
- browser sessions get per-site egress (same proxy as HTTP, or direct)
- site account page shows UA source; raw UA in tech info

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/db/src/types.ts

@@ -569,6 +569,7 @@ export interface BrowserProviderTable {
   config: Generated<Json>;
   created_at: GeneratedTimestamptz;
   updated_at: GeneratedTimestamptz;
+  identity: Json | null;
 }
 
 export interface BrowserSessionTable {
@@ -1409,6 +1410,7 @@ export interface SiteAccountTable {
   last_error: Json | null;
   user_data: Json | null;
   user_data_at: Timestamptz | null;
+  ua_pending: string | null;
 }
 
 export interface SiteRequestCountTable {