fix: drop source header (breaks msg/chats) + context-aware talker_id

Live validation found two real bugs:
- YunkeClient sent 'source: yunkepc' on every request; msg/chats binds
  source as Integer -> 500. Removed (cookie auth suffices, per Phase 0).
- WeChat message talker_id used the masked 'talker' field; the timeline
  joins on the full peer id. Now: 1:1 -> oriTalker (full), group -> talker
  (member). ori_talker keeps the raw oriTalker (peer/chatroom).

Co-Authored-By: Claude <noreply@anthropic.com>

yunke-server/tests/test_yunke_client.py

@@ -127,7 +127,10 @@ async def test_post_injects_auth_headers(client: YunkeClient):
     # The 5 known auth headers must be on every outgoing request.
     assert sent.headers["userid"] == USERID
     assert sent.headers["company"] == COMPANY
-    assert sent.headers["source"] == "yunkepc"
+    # NOTE: ``source`` is intentionally NOT sent — several endpoints (msg/chats)
+    # bind a ``source`` param as Integer, so ``source: "yunkepc"`` 500s. Cookie
+    # auth suffices for all data endpoints (Phase 0).
+    assert "source" not in sent.headers
     assert sent.headers["channel"] == "4"
     assert sent.headers["content-type"] == "application/json"
     # And the session cookie travels along too.

yunke-server/tests/test_yunke_client_stealth.py

@@ -113,7 +113,7 @@ async def test_browser_headers_present_on_every_request(client: YunkeClient):
     assert sent["sec-ch-ua-platform"] == '"Windows"'
     assert sent["referer"] == "https://crm2.yunkecn.com/"
     # The existing auth headers still ride along unchanged.
-    assert sent["source"] == "yunkepc"
+    assert "source" not in sent  # omitted: breaks msg/chats Integer binding
     assert sent["channel"] == "4"
     assert sent["userid"] == USERID
     assert sent["company"] == COMPANY