feat(http): use httpx with pooled connections and browser headers

Add httpx and route Bilibili and Telegram requests through pooled clients with keepalive and explicit timeouts. Align Bilibili headers with data/raw-request.txt: Chrome 155 UA, sec-ch-ua, space.bilibili.com origin, folder-specific referer, and priority header. Close replaced clients when credentials change. Add transport contract tests and live read-only validation for nav, folder sync, WBI search, and Telegram getUpdates.

reaction_board/bilibili/auth.py

@@ -45,15 +45,16 @@ def strip_identity(cookie: str) -> str:
     return "; ".join(kept)
 
 
-def make_headers(cfg: dict, auth: bool = False) -> dict[str, str]:
-    """构造 B 站 Web 请求头；``auth=False`` 时去掉账号身份 cookie。"""
+def make_headers(cfg: dict, auth: bool = False, *, referer: str | None = None) -> dict[str, str]:
+    """构造与 ``data/raw-request.txt`` 对齐的 B 站 Web 请求头。"""
     return {
         "accept": "*/*",
         "accept-language": "zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7",
         "cookie": cfg["cookie"] if auth else strip_identity(cfg["cookie"]),
         "dnt": "1",
-        "origin": "https://www.bilibili.com",
-        "referer": "https://www.bilibili.com/",
+        "origin": "https://space.bilibili.com",
+        "priority": "u=1, i",
+        "referer": referer or "https://space.bilibili.com/",
         "sec-ch-ua": '"Google Chrome";v="155", "Chromium";v="155", "Not(A:Brand";v="24"',
         "sec-ch-ua-mobile": "?0",
         "sec-ch-ua-platform": '"Windows"',