feat(opc): 客户端标记 X-Client:desktop(来源零推断)

- 所有 API 请求带 X-Client:desktop, server-core /auth 据此识别 source=desktop

console/src/api/authHeaders.ts

@@ -4,6 +4,8 @@ import { useAuthStore } from "../auth/authStore";
 /** Authorization + X-Agent-Id + X-Port-Id for API requests. Caller sets Content-Type when needed. */
 export function buildAuthHeaders(): Record<string, string> {
   const headers: Record<string, string> = {};
+  // 客户端来源：server-core /auth 据此识别用户来源(desktop)→source，零推断
+  headers["X-Client"] = "desktop";
   const token = getApiToken();
   if (token) {
     headers.Authorization = `Bearer ${token}`;