fix: Cloudflare 403 broke Power-trial start (missing User-Agent)

The REAL cause of 'Start trial does nothing' and the sign-in auto-start miss —
not a race. api.heard.dev is behind Cloudflare, which 403s a bare urllib request
(default UA). The daemon's /v1/me poll and its trial net send User-Agent, so they
worked; the sign-in enroll (_maybe_start_power_trial), the Settings button
(_act_start_power_trial), and the byok /v1/me refresh (_refresh_byok_enabled) did
NOT — so all three silently 403'd. Log confirmed: 'sign-in autostart failed: HTTP
Error 403: Forbidden' while 'power_trial_autostarted via=daemon_poll' succeeded.

Adds User-Agent to all three. Same CF-1010/403 class as the Groq key needing a
UA. persona.py already had one.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019GTBZjBGurqsHUHsjaU1gA

Author: sodiumsun

heard/home_window.py

@@ -816,7 +816,12 @@ def _work():
                     req = urllib.request.Request(
                         f"{base}/v1/power/trial/start",
                         method="POST",
-                        headers={"Authorization": f"Bearer {token}"},
+                        # User-Agent REQUIRED — Cloudflare 403s a bare urllib
+                        # request, which made this button silently do nothing.
+                        headers={
+                            "Authorization": f"Bearer {token}",
+                            "User-Agent": "Heard-app/1.0",
+                        },
                     )
                     with urllib.request.urlopen(req, timeout=10) as r:  # noqa: S310
                         data = json.loads(r.read().decode() or "{}")

heard/url_scheme.py

@@ -93,7 +93,9 @@ def _maybe_start_power_trial(token: str) -> None:
         req = urllib.request.Request(
             f"{base}/v1/power/trial/start",
             method="POST",
-            headers={"Authorization": f"Bearer {token}"},
+            # User-Agent is REQUIRED: Cloudflare (in front of api.heard.dev) 403s
+            # a bare urllib request. Without it the trial silently never starts.
+            headers={"Authorization": f"Bearer {token}", "User-Agent": "Heard-app/1.0"},
         )
         with urllib.request.urlopen(req, timeout=10) as r:  # noqa: S310
             data = json.loads(r.read().decode() or "{}")
@@ -124,7 +126,8 @@ def _refresh_byok_enabled(token: str) -> None:
 
         base = config.load().get("heard_api_base") or "https://api.heard.dev"
         req = urllib.request.Request(
-            f"{base}/v1/me", headers={"Authorization": f"Bearer {token}"}
+            f"{base}/v1/me",
+            headers={"Authorization": f"Bearer {token}", "User-Agent": "Heard-app/1.0"}
         )
         with urllib.request.urlopen(req, timeout=10) as r:  # noqa: S310
             data = json.loads(r.read().decode() or "{}")