fix: drop source header (breaks msg/chats) + context-aware talker_id

Live validation found two real bugs:
- YunkeClient sent 'source: yunkepc' on every request; msg/chats binds
  source as Integer -> 500. Removed (cookie auth suffices, per Phase 0).
- WeChat message talker_id used the masked 'talker' field; the timeline
  joins on the full peer id. Now: 1:1 -> oriTalker (full), group -> talker
  (member). ori_talker keeps the raw oriTalker (peer/chatroom).

Co-Authored-By: Claude <noreply@anthropic.com>

yunke-server/app/scraper/wechat.py

@@ -346,11 +346,21 @@ def _normalize_message(record: dict[str, Any]) -> dict[str, Any]:
     if timestamp is None:
         timestamp = record.get("createTime")
 
+    # talker_id = the message's sender/peer FULL id (the timeline join key).
+    # 1:1 (empty roomid): upstream `talker` is masked, the full peer is
+    # `oriTalker`. group (roomid set): `talker` is the sending member, while
+    # `oriTalker` is the chatroom id — so the member is in `talker`.
+    roomid = record.get("roomid") or ""
+    if roomid:
+        talker_id = record.get("talker")
+    else:
+        talker_id = record.get("oriTalker") or record.get("talker")
+
     return {
         "msg_id": record.get("msgSvrId"),
         "channel": "wechat",
         "owner_account_id": record.get("wechatId"),
-        "talker_id": record.get("talker"),
+        "talker_id": talker_id,
         "ori_talker": record.get("oriTalker"),
         "room_id": record.get("roomid"),
         "is_send": is_send,

yunke-server/app/session/yunke_client.py

@@ -42,10 +42,13 @@ from app.session.login import (
     pc_login,
 )
 
-# The 4 constant auth headers. ``userid`` + ``company`` come from the
-# LoginResult and are merged in separately.
+# Constant auth headers. ``userid`` + ``company`` come from the LoginResult
+# and are merged in separately. NOTE: ``source`` is intentionally NOT sent —
+# the real CRM session cookie authenticates data APIs (confirmed in Phase 0),
+# and several endpoints (e.g. ``msg/chats``) bind a ``source`` parameter as
+# Integer, so a ``source: "yunkepc"`` header makes them 500. Cookie-only auth
+# works for all data endpoints.
 _STATIC_AUTH_HEADERS: dict[str, str] = {
-    "source": "yunkepc",
     "channel": "4",
     "content-type": "application/json",
 }