feat: one-click upstream auth refresh from custom page viewer

- Add linked_upstream_id to CustomPage model with DB migration
- New POST /api/custom-pages/{pid}/refresh-auth endpoint extracts
  credentials from active remote browser and updates linked upstream
- PageViewer toolbar shows key icon button when page has linked upstream
- CustomPages form adds upstream dropdown for remote_browser pages
- Auth capture extracts New-Api-User from localStorage uid/user/self API
- Upstream client sends New-Api-User header in cookie auth mode
- Fix auth capture dialog: transparent background, field persistence,
  login URL defaults to base_url/login, focus on click for keyboard input
- Fix upstream test ASCII encoding with non-header characters validation

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

frontend/src/views/PageViewer.vue

@@ -28,6 +28,11 @@
             <el-icon><Right /></el-icon>
           </el-button>
         </el-tooltip>
+        <el-tooltip v-if="canRefreshAuth" content="一键刷新上游凭证">
+          <el-button size="small" text type="warning" :loading="refreshingAuth" @click="refreshAuth">
+            <el-icon><Key /></el-icon>
+          </el-button>
+        </el-tooltip>
         <el-tooltip content="在新标签页打开">
           <el-button size="small" text @click="openExternal">
             <el-icon><TopRight /></el-icon>
@@ -209,6 +214,8 @@ type RemoteBrowserErrorState = {
 
 const pageIcon = computed(() => iconMap[page.value?.icon || 'Link'] || LinkIcon)
 const isRemoteBrowser = computed(() => page.value?.access_mode === 'remote_browser')
+const canRefreshAuth = computed(() => isRemoteBrowser.value && page.value?.linked_upstream_id && remoteSession.value)
+const refreshingAuth = ref(false)
 const effectivePageId = computed(() => props.pageId ?? Number(route.params.id))
 const embedded = computed(() => props.embedded)
 const showRemoteError = computed(() => Boolean(remoteErrorState.value) && !isStartingRemoteBrowser.value)
@@ -430,6 +437,23 @@ async function copyRemoteSelection() {
   }
 }
 
+async function refreshAuth() {
+  if (!page.value) return
+  refreshingAuth.value = true
+  try {
+    const res = await customPagesApi.refreshAuth(page.value.id)
+    if (res.data.success) {
+      ElMessage.success(res.data.message || '凭证已刷新')
+    } else {
+      ElMessage.warning(res.data.message || '刷新失败')
+    }
+  } catch (e: any) {
+    ElMessage.error(e.response?.data?.detail || '刷新凭证失败')
+  } finally {
+    refreshingAuth.value = false
+  }
+}
+
 function remoteViewport() {
   const rect = remoteFrameRef.value?.getBoundingClientRect()
   return {