fix: drop source header (breaks msg/chats) + context-aware talker_id

Live validation found two real bugs:
- YunkeClient sent 'source: yunkepc' on every request; msg/chats binds
  source as Integer -> 500. Removed (cookie auth suffices, per Phase 0).
- WeChat message talker_id used the masked 'talker' field; the timeline
  joins on the full peer id. Now: 1:1 -> oriTalker (full), group -> talker
  (member). ori_talker keeps the raw oriTalker (peer/chatroom).

Co-Authored-By: Claude <noreply@anthropic.com>

yunke-server/app/session/yunke_client.py

@@ -42,10 +42,13 @@ from app.session.login import (
     pc_login,
 )
 
-# The 4 constant auth headers. ``userid`` + ``company`` come from the
-# LoginResult and are merged in separately.
+# Constant auth headers. ``userid`` + ``company`` come from the LoginResult
+# and are merged in separately. NOTE: ``source`` is intentionally NOT sent —
+# the real CRM session cookie authenticates data APIs (confirmed in Phase 0),
+# and several endpoints (e.g. ``msg/chats``) bind a ``source`` parameter as
+# Integer, so a ``source: "yunkepc"`` header makes them 500. Cookie-only auth
+# works for all data endpoints.
 _STATIC_AUTH_HEADERS: dict[str, str] = {
-    "source": "yunkepc",
     "channel": "4",
     "content-type": "application/json",
 }