feat(auth): 来源上报 X-Client(web/miniprogram)

- website fetch 带 X-Client:web; miniprogram 统一请求带 X-Client:miniprogram
- server-core /auth 据此识别 source, 零推断(与 desktop 端对应)

miniprogram/src/utils/api.js

@@ -12,7 +12,7 @@ const API_BASE = 'https://opc.pinesound.cn'; // 云超服 FastAPI 后端（备
  */
 export function request(method, path, data = {}, withAuth = false) {
   return new Promise((resolve, reject) => {
-    const header = { 'Content-Type': 'application/json' };
+    const header = { 'Content-Type': 'application/json', 'X-Client': 'miniprogram' };
     if (withAuth) {
       const token = Taro.getStorageSync('pine_token');
       if (token) header.Authorization = `Bearer ${token}`;