feat(http): use httpx with pooled connections and browser headers

Add httpx and route Bilibili and Telegram requests through pooled clients with keepalive and explicit timeouts. Align Bilibili headers with data/raw-request.txt: Chrome 155 UA, sec-ch-ua, space.bilibili.com origin, folder-specific referer, and priority header. Close replaced clients when credentials change. Add transport contract tests and live read-only validation for nav, folder sync, WBI search, and Telegram getUpdates.

README.md

@@ -258,6 +258,8 @@ uv run python app.py auth --account read --timeout 180
 
 只读客户端对 `ids` / `infos` 默认剥离 `read` 身份 Cookie，仅保留该账号设备指纹；如果失败才使用完整 `read` Cookie 重试。写操作一律使用完整 `write` Cookie 与 CSRF。
 
+B 站请求通过 `httpx` 连接池发送，并按 `data/raw-request.txt` 对齐 Chrome 155 的 UA、`sec-ch-ua`、`origin`、`referer` 和 `priority` 等请求头；收藏夹请求的 `referer` 会带上目标 `media_id`。
+
 `x/v3/fav/resource/sort` 的实测语义为：
 
 ```text
@@ -278,6 +280,7 @@ uv run python tests/test_migrations.py      # 迁移、备份、回滚与保留
 uv run python tests/test_database.py        # 单写队列、事务与并发
 uv run python tests/test_repository.py      # 收藏夹/视频状态机与黑名单
 uv run python tests/test_bilibili_client.py # ids/infos/view/fans/nav 契约与重试
+uv run python tests/test_httpx_transport.py # httpx B 站/Telegram 传输层
 uv run python tests/test_classify.py        # 标题归一化、时长解析与打分
 uv run python tests/test_search.py          # WBI 签名、搜索解析与降级
 uv run python tests/test_candidates.py      # 候选池、去重、通知与 fav_action