feat(auth): 来源上报 X-Client(web/miniprogram)

- website fetch 带 X-Client:web; miniprogram 统一请求带 X-Client:miniprogram
- server-core /auth 据此识别 source, 零推断(与 desktop 端对应)

miniprogram/src/utils/api.js

@@ -12,7 +12,7 @@ const API_BASE = 'https://opc.pinesound.cn'; // 云超服 FastAPI 后端（备
  */
 export function request(method, path, data = {}, withAuth = false) {
   return new Promise((resolve, reject) => {
-    const header = { 'Content-Type': 'application/json' };
+    const header = { 'Content-Type': 'application/json', 'X-Client': 'miniprogram' };
     if (withAuth) {
       const token = Taro.getStorageSync('pine_token');
       if (token) header.Authorization = `Bearer ${token}`;

website/src/services/auth.js

@@ -24,7 +24,7 @@ export async function sendCode(phone) {
   try {
     res = await fetch(`${API_BASE}/api/auth/send-code`, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: { 'Content-Type': 'application/json', 'X-Client': 'web' },
       body: JSON.stringify({ phone })
     });
   } catch {
@@ -40,7 +40,7 @@ export async function phoneLogin(phone, code) {
   try {
     res = await fetch(`${API_BASE}/api/auth/phone-login`, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: { 'Content-Type': 'application/json', 'X-Client': 'web' },
       body: JSON.stringify({ phone, code })
     });
   } catch {
@@ -58,7 +58,7 @@ export async function login(username, password) {
   try {
     res = await fetch(`${API_BASE}/api/auth/login`, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: { 'Content-Type': 'application/json', 'X-Client': 'web' },
       body: JSON.stringify({ username, password })
     });
   } catch {