feat: remote browser login persistence + balance display + UI consistency

- Retain login state in remote browser profiles (don't delete on disconnect)
- Add GET /api/browser-sessions/{id}/clipboard for clipboard sync
- Add POST /api/browser-sessions/{id}/autofill-login for manual credential fill
- Add DELETE /api/browser-sessions/profiles/{custom_page_id} for login clear
- Add balance tracking with configurable divisor (balance_divisor)
- Health check on session reuse, idle TTL eviction, background cleanup
- Add first-frame watchdog (10s timeout) to prevent infinite loading
- Reconnect browser on active=true when session was closed
- UI: uniform text-only inline buttons (websites + upstreams pages)
- Fix page switch race with closingRemoteSessionPromise

backend/app/routers/custom_pages.py

@@ -270,7 +270,20 @@ async def refresh_auth(pid: int, db: Session = Depends(get_db), _=Depends(get_cu
             existing_config["new_api_user"] = candidate["new_api_user"]
     elif ctype == "bearer_token":
         upstream.auth_type = "bearer"
-        existing_config["token"] = candidate.get("value", "")
+        raw = candidate.get("value", "")
+        # Clean up: strip whitespace, remove "Bearer " prefix if present
+        token = raw.strip()
+        if token.startswith("Bearer "):
+            token = token[7:].strip()
+        # Validate token can be used as HTTP header value
+        try:
+            token.encode("latin-1")
+        except UnicodeEncodeError:
+            return RefreshAuthResponse(
+                success=False,
+                message=f"提取到的 Token 含有非 HTTP 标头字符，请确认已在远程浏览器中正确登录并重试",
+            )
+        existing_config["token"] = token
     elif ctype == "api_key":
         upstream.auth_type = "api_key"
         existing_config["key"] = candidate.get("value", "")