feat(http): use httpx with pooled connections and browser headers

Add httpx and route Bilibili and Telegram requests through pooled clients with keepalive and explicit timeouts. Align Bilibili headers with data/raw-request.txt: Chrome 155 UA, sec-ch-ua, space.bilibili.com origin, folder-specific referer, and priority header. Close replaced clients when credentials change. Add transport contract tests and live read-only validation for nav, folder sync, WBI search, and Telegram getUpdates.

tests/test_auth.py

@@ -13,6 +13,7 @@ sys.stdout.reconfigure(encoding="utf-8")
 from reaction_board.bilibili.auth import (  # noqa: E402
     cookie_value,
     cookies_from_set_cookie,
+    make_headers,
     merge_cookie,
     parse_cookie,
     sessdata_expiry,
@@ -78,10 +79,30 @@ def test_qr_png():
         assert path.read_bytes().startswith(b"\x89PNG\r\n\x1a\n")
 
 
+def test_make_headers_matches_raw_request():
+    headers = make_headers({"cookie": "SESSDATA=x; buvid3=y"}, auth=False)
+    assert headers["origin"] == "https://space.bilibili.com"
+    assert headers["referer"] == "https://space.bilibili.com/"
+    assert headers["priority"] == "u=1, i"
+    assert headers["user-agent"].endswith("Chrome/155.0.0.0 Safari/537.36")
+    assert headers["sec-ch-ua"].startswith('"Google Chrome";v="155"')
+    assert "SESSDATA" not in headers["cookie"]
+    assert "buvid3=y" in headers["cookie"]
+
+    full = make_headers({"cookie": "SESSDATA=x"}, auth=True)
+    assert full["cookie"] == "SESSDATA=x"
+
+    custom = make_headers(
+        {"cookie": ""}, referer="https://space.bilibili.com/1/favlist?fid=2"
+    )
+    assert custom["referer"] == "https://space.bilibili.com/1/favlist?fid=2"
+
+
 def main():
     test_cookie_helpers()
     test_finish_updates_only_selected_account_and_rolls_back()
     test_qr_png()
+    test_make_headers_matches_raw_request()
     print("OK: 双账号 auth Cookie 合并、写回隔离与回滚测试全部通过")