feat: CDP 接管开关 + 扫码登录面板 + Docker 部署

- runner: enable_cdp_mode 从硬编码 False 改为系统设置 cdp_enabled。服务器部署下爬虫接管已开启远程调试的 Chrome（默认 9222），复用其 profile 登录态；本机桌面默认仍为关，行为不变
- qrlogin: 新增 CDP 扫码登录。Chrome 在服务器上跑于 Xvfb，show_qrcode 依赖的 PIL 桌面看图程序不存在，二维码无处可显示；改为经 CDP 从页面取出二维码交给 WebUI 渲染。刻意复用 browser.contexts[0]（新建 context 是无痕 profile，扫了也白扫），且绝不调用 browser.close()（会连带关掉操作者自己的 Chrome）
- webui: 设置页新增扫码面板，替换原本跳到采集页看终端二维码的入口
- Dockerfile / .dockerignore / docker-compose.yml: 服务器部署。host 网络是必需而非图省事——容器里 127.0.0.1:9222 必须落到宿主机回环
- UPSTREAM.md: 补充 gitcode 镜像，用于 GitHub 大包传输必断时补历史

api/monitor/runner.py

@@ -162,6 +162,11 @@ async def execute_task(task_id: int, trigger: str = "manual") -> IngestResult:
         urls = build_target_urls(task.mode, targets)
         cookie = await get_cookie(session, platform)
         strategy = await _strategy_settings(session, platform)
+        # System-wide switch. On a headless server the crawler must attach to the
+        # Chrome already listening on the debug port -- that browser is where the
+        # operator scanned the login QR, so its profile is the login. Default False
+        # keeps desktop runs launching a private browser exactly as before.
+        cdp_enabled = await app_settings.get_value(session, "cdp_enabled", fallback=False)
 
         run = MonitorRun(
             task_id=task.id,
@@ -209,8 +214,9 @@ async def execute_task(task_id: int, trigger: str = "manual") -> IngestResult:
         # Isolate this run's output: the crawler names files by date only, so
         # otherwise same-day runs would append into one shared file.
         save_data_path=str(out_dir),
-        # Unattended runs must not try to attach to the user's desktop Chrome.
-        enable_cdp_mode=False,
+        # Attach to the browser already running on CDP_DEBUG_PORT when the
+        # operator enabled it; otherwise launch a private, throwaway browser.
+        enable_cdp_mode=cdp_enabled,
         # Only injecting web_session is not enough to sign requests from a cold
         # browser profile.
         inject_all_cookies=True,