feat(ncm): MUSIC_U 临期主动续期 — 启动查龄超阈值后台静默刷新/eapi 会话锚点/cookie 合并+冷却

用户定案：失效前用当前 cookie 换新登录态（用户无感）；仅刷新失败才退扫码重登。

- core/ncm_req.c|h：eapi Cookie 头补齐会话锚点 MUSIC_U/MUSIC_A（对齐 request.rs，
  补 §36.5 遗留——登录刷新/song_url 会员档依赖）；新增 ncm_req_cookie_merge
  （patch 覆盖 base 同名 cookie，MUSIC_A/__remember_me 等不丢）。
- core/ncm_login.c|h：ncm_login_refresh（eapi /api/login/token/refresh 空体，
  code200+set-cookie→merge；code!=200→NCM_ERR_AUTH 退扫码；网络/TLS→负码退避）。
- app/logic/account.c：account.json 增 last_refresh_ts + 拆分 cvip/svip；
  account_cookie_maybe_refresh（年龄阈值 12h 可配 ncm.cookie_refresh_h，单飞/boot，
  失败冷却 30min 跨 boot 持久化，AUTH 置回登录页标志）+ mark_fresh/need_relogin。
- app/ui/home.c：home_worker 先续期再拉歌单；app/ui/login.c：803 落盘后 mark_fresh；
  app/app.c：UI tick 消费回登录标志 → logout+切登录页。
- 新增测试：test_ncm_core 的 cookie_merge + eapi_musicu_hdr；bench/cookie_refresh_sim
  （端点语义，0 网络）；bench/account_cookie_sim（临期/未临期/退避/失效/冷却，0 网络）。

验证：host+qemu 核心测试 PASS；build_ncm_sims.sh 全家桶 PASS；build_ncm.sh 0 warning。
真机只读探针 2 次（设备 10.78.193.50，不写回）：refresh 走 eapi 域
interface.music.163.com 在当前网络被 TLS reset（alert 80）→ rc=-5 瞬断退避，
session.enc/deviceId md5 前后一致（登录态零损伤）。新 ncm md5 c960244b。

patch_v2/ncm_app/test/test_ncm_core.c

@@ -189,6 +189,51 @@ static void test_crypto_vectors(void) {
     CHECK(strcmp(a, b) == 0, "eapi deterministic for same input");
 }
 
+static void test_cookie_merge(void) {
+    /* §NEW 登录续期：patch 的 MUSIC_U/__csrf 覆盖 base 同名字段，其余 base 字段保留。 */
+    printf("== cookie merge (login refresh) ==\n");
+    char out[4096];
+    const char *base = "__csrf=old_csrf; MUSIC_A=anon; __remember_me=true; MUSIC_U=OLD_TOKEN_LONG_1234567890";
+    const char *patch = "MUSIC_U=NEW_TOKEN_abcdef; __csrf=new_csrf";
+    CHECKRC(ncm_req_cookie_merge(base, patch, out, sizeof out), "merge rc");
+    char v[64];
+    CHECK(ncm_req_cookie_get(out, "MUSIC_U", v, sizeof v) == NCM_OK &&
+          strcmp(v, "NEW_TOKEN_abcdef") == 0, "MUSIC_U replaced (got %s)", v);
+    CHECK(ncm_req_cookie_get(out, "__csrf", v, sizeof v) == NCM_OK &&
+          strcmp(v, "new_csrf") == 0, "__csrf replaced (got %s)", v);
+    CHECK(ncm_req_cookie_get(out, "MUSIC_A", v, sizeof v) == NCM_OK &&
+          strcmp(v, "anon") == 0, "MUSIC_A preserved (got %s)", v);
+    CHECK(ncm_req_cookie_get(out, "__remember_me", v, sizeof v) == NCM_OK &&
+          strcmp(v, "true") == 0, "__remember_me preserved (got %s)", v);
+
+    /* 空 patch（响应无 set-cookie）= 原样返回 base */
+    char out2[4096];
+    CHECKRC(ncm_req_cookie_merge(base, "", out2, sizeof out2), "merge with empty patch rc");
+    CHECK(strcmp(out2, base) == 0, "empty patch keeps base unchanged");
+}
+
+static void test_eapi_musicu_hdr(void) {
+    /* §NEW eapi Cookie 头须带 MUSIC_U（session 锚点，login_refresh/song_url 会员档依赖）。
+     * 这里只构建请求，不打网络——验证 Cookie 头包含 MUSIC_U=（值 urlencode 后附加）。 */
+    printf("== eapi cookie header carries MUSIC_U ==\n");
+    const char *device = "AA11BB22CC33DD44EE55FF6600112233445566778899AABB00";
+    const char *cookie = "__csrf=c; MUSIC_U=MyMusicUToken1a2b; MUSIC_A=guestA";
+    char body[NCM_REQ_BODY_MAX], hdrs[NCM_REQ_HDRS_MAX], url[NCM_REQ_URL_MAX];
+    CHECKRC(ncm_req_build(device, cookie, "/api/login/token/refresh", "{}", NCM_CRYPT_EAPI,
+                          body, sizeof body, hdrs, sizeof hdrs, url, sizeof url),
+            "eapi build rc");
+    CHECK(strstr(hdrs, "MUSIC_U=MyMusicUToken1a2b") != NULL, "Cookie header has MUSIC_U");
+    CHECK(strstr(hdrs, "MUSIC_A=guestA") != NULL, "Cookie header has MUSIC_A");
+    CHECK(strstr(url, "/eapi/login/token/refresh") != NULL, "url is eapi login/token/refresh");
+
+    /* 游客（无 MUSIC_U/A）+ 非 login 路径 → 补 anonymous_token 兜底 */
+    char h2[NCM_REQ_HDRS_MAX], b2[NCM_REQ_BODY_MAX], u2[NCM_REQ_URL_MAX];
+    CHECKRC(ncm_req_build(device, "", "/api/song/lyric", "{\"id\":1}", NCM_CRYPT_EAPI,
+                          b2, sizeof b2, h2, sizeof h2, u2, sizeof u2), "guest eapi build rc");
+    CHECK(strstr(h2, "MUSIC_A=anonymous_token") != NULL, "guest eapi injected anonymous MUSIC_A");
+    CHECK(strstr(h2, "MUSIC_U=") == NULL, "guest eapi has no MUSIC_U");
+}
+
 static void test_network(void) {
     printf("== network (live) ==\n");
     int net_ok = 0;
@@ -468,6 +513,8 @@ int main(int argc, char **argv) {
     test_store_cookie();
     test_cache();
     test_qr();
+    test_cookie_merge();
+    test_eapi_musicu_hdr();
     test_network();
     test_track_all_parse();
     test_vip_parse();