fix(xueqiu): fix 400 errors by using browser cookies and correct headers

The Xueqiu stock API requires a login session token (xq_a_token) that
is generated by Xueqiu's frontend JavaScript and cannot be obtained by
simply visiting the homepage. This caused persistent HTTP 400 (error
code 400016) for all users.

Changes:
- _ensure_cookies(): add three-level priority — config file (saved by
  --from-browser) → live Chrome cookies via browser_cookie3 → homepage
  fallback. The homepage-only approach only ever got acw_tc (anti-DDoS
  token), never xq_a_token.
- _get_json(): switch User-Agent from "agent-reach/1.0" to a real Chrome
  UA, and add Referer: https://xueqiu.com/ to all API requests.
- get_hot_posts(): replace the defunct /statuses/hot/listV3.json endpoint
  (returns empty body) with the v4 public timeline endpoint; correctly
  parse item.data as a JSON string to extract author, text, and likes.
- cookie_extract.py: add Xueqiu to PLATFORM_SPECS and configure_from_browser
  so that `agent-reach configure --from-browser chrome` now also saves
  Xueqiu cookies (only when xq_a_token is present).
- check(): improve error message to direct users to --from-browser instead
  of suggesting a proxy.
- Fix urllib.parse.quote usage (was using urllib.request.quote).
- Update tier and backends description to reflect cookie requirement.
- Add 2 new tests: cookie loading from config, Referer/UA header verification.
- Update docs: README, install guide, troubleshooting, SKILL.md, CHANGELOG.

docs/troubleshooting.md

@@ -1,5 +1,21 @@
 # 常见问题排查
 
+## 雪球 / Xueqiu: API 返回 400
+
+**症状：** `agent-reach doctor` 显示雪球 ⚠️，报 `HTTP Error 400`
+
+**原因：** 雪球 API 需要登录 Cookie，无法通过匿名访问获取。
+
+**解决方案：** 在 Chrome 里登录 xueqiu.com，然后运行：
+
+```bash
+agent-reach configure --from-browser chrome
+```
+
+再次运行 `agent-reach doctor` 确认恢复 ✅。Cookie 过期后重新运行即可。
+
+---
+
 ## Twitter/X: bird CLI 连接失败
 
 **症状：** `bird search` 或其他命令返回错误