feat: QR login, AcFun settings panel, and 动态 (moment) tools

- scan.acfun.cn QR flow (start -> long-poll scanResult -> acceptResult) with
  rotated-signature handling, background poller, durable session in the Host
  credential service, and cookie handoff to the provider
- Client half: Settings -> AcFun page (status, QR code, poll, logout) over a
  same-origin /acfun-panel JSON API with cross-origin rejection
- acfun_moment / acfun_moment_comments / acfun_topic read tools, moment_like /
  moment_unlike / moment_banana actions, and comment posting on moments
- acfun_account status tool; docs for the QR contract, the 广场/动态 research
  verdict, and the client-composition restart requirement

skills/plugin-tool-acfun/SKILL.md

@@ -1,15 +1,16 @@
 ---
 name: acfun
-description: Use DeepSeek Harness's AcFun (A站, acfun.cn) tools to search videos, read video metadata, comment threads, danmaku, the day/week ranking, and playable m3u8 URLs; also like/unlike, tip bananas, favorite, follow, and post comments when the user has enabled AcFun write actions. Use when the user asks about AcFun / A 站 videos, wants a video's details, comments or 弹幕, the A 站 ranking, a playable/downloadable stream URL, or asks to interact on AcFun.
+description: Use DeepSeek Harness's AcFun (A站, acfun.cn) tools to search videos, read video metadata, comment threads, danmaku, the day/week ranking, playable m3u8 URLs and 动态 (moments); also like/unlike, tip bananas, favorite, follow, comment, and interact with moments when the user enabled AcFun write actions. Use when the user asks about AcFun / A 站 videos, wants a video's details, comments or 弹幕, the A 站 ranking, a playable stream URL, a 动态 (moment) or 社区圈 topic, or asks to interact on AcFun.
 ---
 
 # AcFun tools
 
-Eight tools talk to acfun.cn through the `dsh-plugin-acfun` bundle. Six are
-anonymous reads; two can mutate the configured account and are disabled unless
-the user opted in.
+Twelve tools talk to acfun.cn through the `dsh-plugin-acfun` bundle. Nine are
+anonymous reads; `acfun_interact` and `acfun_post_comment` mutate the configured
+account and are disabled unless the user opted in. Login happens in the Harness
+Web UI (**Settings → AcFun**, QR code) or through a cookie in the plugin config.
 
-## Read workflow
+## Video workflow
 
 1. `acfun_search` — keyword search. Pass `sort: "views"` only when the user wants
    popular videos; AcFun returns at most its first 30 results and ignores paging,
@@ -25,29 +26,51 @@ the user opted in.
 6. `acfun_playurl` — m3u8 ladder; name a `quality` such as `"720P"` or omit it
    for the highest. URLs are time-limited, so do not cache them in prose.
 
+## 动态 (moment) workflow
+
+AcFun has **no public 广场 feed**: do not promise a browsable square and do not
+invent ids. Reaching moments works like this:
+
+1. `acfun_topic` with a numeric topic id (for example `488` for 教育) — the only
+   public discovery surface. It parses the mobile 社区圈 page and returns at most
+   15 newest items; only `resourceType: 3` items carry a `momentId`. There is no
+   pagination, so say that instead of retrying with a page parameter.
+2. `acfun_moment` with that `momentId` (or a
+   `https://m.acfun.cn/communityCircle/moment/...` share link) — full text,
+   topics, images, author, counts and the canonical share URL.
+3. `acfun_moment_comments` — the moment's comment thread; moments use a different
+   comment enum than videos, which is why this is a separate tool.
+4. Cite the returned `shareUrl`. A moment's `tagList` ids feed `acfun_topic`.
+
+Publishing, deleting, reposting and voting on a 动态 are app-only (signed token);
+refuse them and explain, rather than attempting a creative workaround.
+
 ## Interaction workflow
 
-`acfun_interact` (`like`, `unlike`, `banana`, `favorite`, `unfavorite`,
-`follow`, `unfollow`) and `acfun_post_comment` require
-`allowWriteActions: true` plus a login cookie in the plugin config.
+`acfun_interact` — video actions `like`, `unlike`, `banana`, `favorite`,
+`unfavorite`, `follow`, `unfollow`; moment actions `moment_like`,
+`moment_unlike`, `moment_banana`. `acfun_post_comment` posts on a video (`acId`)
+or a 动态 (`momentId`). All require `allowWriteActions: true` plus a login.
 
 - Only act when the user explicitly asked for that interaction. Do not "helpfully"
   like, follow, favorite, or comment on something you merely read.
-- Before a mutating call, state what will happen and on which video/user. For
-  comments, show the exact text if the user did not already dictate it.
+- Before a mutating call, state what will happen and on which video, moment, or
+  user. For comments, show the exact text if the user did not already dictate it.
 - Make the call at most once. If the result is ambiguous, re-read with
-  `acfun_video` / `acfun_comments` instead of repeating the mutation.
+  `acfun_video` / `acfun_comments` / `acfun_moment_comments` instead of repeating
+  the mutation.
+- Moment writes are newer and less verified than video writes; treat them as
+  experimental and never retry blindly.
 - `WRITE_DISABLED` means `allowWriteActions` is false; `LOGIN_REQUIRED` means the
-  cookie is missing or expired. Report the exact missing config key and stop —
-  do not retry the same call.
+  session is missing or expired — point the user to Settings → AcFun and stop.
 - `CAPTCHA_REQUIRED` means AcFun wants an interactive verification; ask the user
   to complete it in a browser, then continue later.
 
 ## Citing and reporting
 
-- When you use a video's content, cite its `url` as a markdown link.
-- Prefer the compact tables/lists the tools render; do not dump raw JSON.
+- When you use content, cite its `url` / `shareUrl` as a markdown link.
+- Prefer the compact text the tools render; do not dump raw JSON.
 - Mention the limitations that affect the answer: search cannot paginate, bangumi
-  and article pages are unsupported, and play URLs expire.
-- Never invent fields the tools did not return. Counts that AcFun only exposes as
+  and article pages are unsupported, play URLs expire, 广场 has no public feed.
+- Never invent fields the tools did not return. Counts AcFun exposes only as
   formatted text (`likeCountText`, `commentCountText`) must be quoted as text.