feat(server): gate scheduling, search and login by site capabilities (IA-2)

- snapshots only for sites with list; feed polling only for RSS kinds;
  user data / health checks only for sites with login; search site set
  only includes searchable sites; live search / snapshot skip with
  reason unsupported instead of hitting the site
- refresh-login / credentials need login, manual snapshot needs list (400)
- POST /sites accepts kind and rssUrl (site + feed in one transaction,
  key generated from host); RSS belongs to a site: feeds created without
  siteId go to the same-host custom RSS source site, siteId cannot be
  cleared
- fix: secret name clash when a site gets a second default-named feed
- command palette regrouped; agent site.list returns kind and
  capabilities; system prompt notes RSS lives under sites

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/agent/test/system-prompt.test.ts

@@ -72,3 +72,12 @@ describe("工作方式(AGUI-3)", () => {
     expect(interactionRules({ options: true, proposeFirst: true }).join("\n")).toContain("本会话要求先看方案再执行");
   });
 });
+
+describe("站点类型(IA-2)", () => {
+  it("RSS 属于站点,没有单独的 RSS 页;按获取方式判断能不能搜索 / 登录", () => {
+    const p = userPrompt();
+    expect(p).toContain("RSS 属于站点");
+    expect(p).toContain("没有单独的 RSS 页");
+    expect(p).toContain("自定义 RSS 源");
+  });
+});