feat(monitoring): add DeepSeek monitoring end-to-end

- desktop: new DeepSeek page adapter and monitor registry
- desktop: extract generic AI auth helpers into shared module and
  skip binding when challenge signals are present
- admin-web: render DeepSeek HTML answers with inline citation anchors
  and surface reference-number badges on source cards
- server: fall back to inline_links/source_panel_links and read
  text/siteName fields when extracting DeepSeek citations

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/desktop-client/src/main/generic-ai-auth.test.ts

@@ -0,0 +1,50 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  buildGenericAIPageFingerprintFallback,
+  genericAIPageLooksAuthenticated,
+} from "./generic-ai-auth";
+
+describe("generic ai auth detection", () => {
+  it("treats deepseek home as authenticated when credential storage exists", () => {
+    expect(genericAIPageLooksAuthenticated("https://chat.deepseek.com/", {
+      displayName: null,
+      avatarUrl: null,
+      fingerprint: "local:userToken=masked",
+      credentialFingerprint: "local:userToken=masked",
+      currentPath: "/",
+      strongAuthSignalCount: 0,
+      loginSignalCount: 0,
+      loggedOutSignalCount: 0,
+      challengeSignalCount: 0,
+    })).toBe(true);
+  });
+
+  it("does not use a non-auth fingerprint as a fallback without strong ui signals", () => {
+    expect(buildGenericAIPageFingerprintFallback("deepseek", {
+      displayName: null,
+      avatarUrl: null,
+      fingerprint: "local:user_unique_id=123",
+      credentialFingerprint: null,
+      currentPath: "/",
+      strongAuthSignalCount: 0,
+      loginSignalCount: 0,
+      loggedOutSignalCount: 0,
+      challengeSignalCount: 0,
+    })).toBeNull();
+  });
+
+  it("builds a stable fingerprint from credential storage when cookies are absent", () => {
+    expect(buildGenericAIPageFingerprintFallback("deepseek", {
+      displayName: null,
+      avatarUrl: null,
+      fingerprint: "local:user_unique_id=123",
+      credentialFingerprint: "local:userToken=masked",
+      currentPath: "/",
+      strongAuthSignalCount: 0,
+      loginSignalCount: 0,
+      loggedOutSignalCount: 0,
+      challengeSignalCount: 0,
+    })).toBe("deepseek-session:local:userToken=masked");
+  });
+});