feat(server): gate scheduling, search and login by site capabilities (IA-2)

- snapshots only for sites with list; feed polling only for RSS kinds;
  user data / health checks only for sites with login; search site set
  only includes searchable sites; live search / snapshot skip with
  reason unsupported instead of hitting the site
- refresh-login / credentials need login, manual snapshot needs list (400)
- POST /sites accepts kind and rssUrl (site + feed in one transaction,
  key generated from host); RSS belongs to a site: feeds created without
  siteId go to the same-host custom RSS source site, siteId cannot be
  cleared
- fix: secret name clash when a site gets a second default-named feed
- command palette regrouped; agent site.list returns kind and
  capabilities; system prompt notes RSS lives under sites

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/server/src/modules/sources-identity/tasks.ts

@@ -245,6 +245,7 @@ export const sourcesOutboxRoutes: Record<string, OutboxRouteFn> = {
   "feed.gap_suspected": (ev) => {
     const p = ev.payload as P;
     if (!p.siteId) return null;
+    // 站点不支持列表抓取时 snapshotSite 自己跳过(reason=unsupported)
     return { task: "snapshotSite", input: { siteId: p.siteId, kind: "backfill", maxPages: BACKFILL_MAX_PAGES } };
   },
 };