feat(http): use httpx with pooled connections and browser headers

Add httpx and route Bilibili and Telegram requests through pooled clients with keepalive and explicit timeouts. Align Bilibili headers with data/raw-request.txt: Chrome 155 UA, sec-ch-ua, space.bilibili.com origin, folder-specific referer, and priority header. Close replaced clients when credentials change. Add transport contract tests and live read-only validation for nav, folder sync, WBI search, and Telegram getUpdates.

reaction_board/bilibili/write_client.py

@@ -18,9 +18,11 @@ from .client import (
 
 
 class BilibiliWriteClient(BilibiliClient):
-    def post_form(self, url: str, data: Mapping[str, Any]) -> dict[str, Any]:
+    def post_form(
+        self, url: str, data: Mapping[str, Any], *, referer: str | None = None
+    ) -> dict[str, Any]:
         self.pacer.wait()
-        headers = self._headers(auth=True)
+        headers = self._headers(auth=True, referer=referer)
         headers["content-type"] = "application/x-www-form-urlencoded"
         body = urllib.parse.urlencode(data).encode("utf-8")
         response = self.transport.request(
@@ -47,6 +49,10 @@ class BilibiliWriteClient(BilibiliClient):
                 "del_media_ids": "",
                 "csrf": self.csrf,
             },
+            referer=(
+                f"https://space.bilibili.com/{self.mid}/favlist"
+                f"?fid={int(folder_id)}&ftype=create"
+            ),
         )
 
     def sort(self, media_id: int, sort_spec: str) -> dict[str, Any]:
@@ -57,4 +63,8 @@ class BilibiliWriteClient(BilibiliClient):
                 "sort": sort_spec,
                 "csrf": self.csrf,
             },
+            referer=(
+                f"https://space.bilibili.com/{self.mid}/favlist"
+                f"?fid={int(media_id)}&ftype=create"
+            ),
         )