feat(browser): fixed Windows identity and per-site egress in umt-cookies plugin (BR-4)

- browser:launching hook generates a Windows fingerprint once (camoufox-js,
  os=windows), persists it to /root/.camofox/umt-identity.json and reuses it
  on every launch; Firefox/Camoufox upgrades only bump UA/version fields
- Windows fontconfig with absolute font dir (upstream path was broken)
- GET /umt/identity (public UA/OS/version) and PUT /umt/sessions/:id/proxy
  (per-context proxy; Firefox no longer uses container HTTP_PROXY env)
- adapter identity()/setEgress(), splitBrowserOnlyCookies for cf_clearance/__cf_bm

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/contracts/src/browser.ts

@@ -304,6 +304,37 @@ export const BrowserCookie = z.object({
 });
 export type BrowserCookie = z.infer<typeof BrowserCookie>;
 
+// ── BR-4 浏览器 UA 与指纹统一 ──
+
+/** 固定浏览器身份的公开部分(umt 插件 GET /umt/identity):不含指纹细节 */
+export const BrowserIdentity = z.object({
+  userAgent: z.string().min(1),
+  os: z.string().nullable(),
+  platform: z.string().nullable(),
+  firefoxVersion: z.string().nullable(),
+  camoufoxVersion: z.string().nullable(),
+  /** 首次生成时的指纹摘要(升级只改 UA / 版本,摘要不变) */
+  fingerprintId: z.string().nullable(),
+  /** 每次升级改写 UA / 版本字段 +1 */
+  revision: z.number().int(),
+  createdAt: z.string().nullable(),
+  updatedAt: z.string().nullable(),
+});
+export type BrowserIdentity = z.infer<typeof BrowserIdentity>;
+
+/** 浏览器会话出口代理(Playwright 形状);null = 直连 */
+export interface BrowserEgressProxy {
+  server: string;
+  username?: string;
+  password?: string;
+}
+
+/**
+ * Cloudflare 的人机验证 Cookie:与取得它的浏览器(UA、IP、TLS 指纹)绑定,HTTP 端(Deno)TLS 指纹不同,拿去用多半无效还可能
+ * 触发风控。浏览器回写账号时剔除,只留在浏览器 profile 里("仅浏览器")。
+ */
+export const BROWSER_ONLY_COOKIES = ["cf_clearance", "__cf_bm"] as const;
+
 /** 站点账号登录态(Cookie)来源:手填 / 账密自动登录 / 浏览器回写 */
 export const SiteCookieSource = z.enum(["manual", "login", "browser"]);
 export type SiteCookieSource = z.infer<typeof SiteCookieSource>;