feat: QR login, AcFun settings panel, and 动态 (moment) tools

- scan.acfun.cn QR flow (start -> long-poll scanResult -> acceptResult) with
  rotated-signature handling, background poller, durable session in the Host
  credential service, and cookie handoff to the provider
- Client half: Settings -> AcFun page (status, QR code, poll, logout) over a
  same-origin /acfun-panel JSON API with cross-origin rejection
- acfun_moment / acfun_moment_comments / acfun_topic read tools, moment_like /
  moment_unlike / moment_banana actions, and comment posting on moments
- acfun_account status tool; docs for the QR contract, the 广场/动态 research
  verdict, and the client-composition restart requirement

package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-plugin-acfun",
   "version": "0.1.0",
-  "description": "DeepSeek Harness plugin: AcFun (A站) video search, metadata, comments, danmaku, day/week ranking, playable m3u8 URLs, and optional cookie-backed interactions (点赞/投蕉/收藏/关注/评论) plus a model-facing skill. Anonymous reads by default; writes stay disabled until both allowWriteActions and a login cookie are configured.",
+  "description": "DeepSeek Harness plugin: AcFun (A站) video search, metadata, comments, danmaku, ranking, play URLs and 动态 (moments), QR-code login, a Settings → AcFun Web UI panel, and optional cookie-backed interactions. Anonymous reads by default; writes stay disabled until allowWriteActions and a login are configured.",
   "keywords": [
     "deepseek-harness",
     "dsh-plugin",
@@ -11,18 +11,21 @@
     "video",
     "danmaku",
     "弹幕",
+    "qr-login",
     "agent-tool"
   ],
   "type": "module",
   "main": "index.js",
   "exports": {
     ".": "./index.js",
+    "./client": "./client.js",
     "./locale/*.json": "./locale/*.json",
     "./icon": "./icon.svg",
     "./package.json": "./package.json"
   },
   "files": [
     "index.js",
+    "client.js",
     "lib/**/*",
     "cordis.patch.yml",
     "locale/*.json",
@@ -38,6 +41,13 @@
   "dsh": {
     "bundle": {
       "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "immediately": true,
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-settings"
+      ]
     }
   },
   "scripts": {