fix: strip Electron UA tokens, refresh bookmark star on in-app navigation

- main.js: app.userAgentFallback cleaned of Electron/X.X and ESH-Media/X.X
  tokens at startup; applied to default/proxy/direct sessions. Google's
  accounts page blocked Electron UA with "Поддержка JavaScript отключена".
- Header.tsx: subscribe currentUrl to updateWebButtons (already fired on
  each in-app navigation). Bookmark star now updates as user clicks
  between movies inside the same opened site, not only on app switch.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

main.js

@@ -110,6 +110,7 @@ let pendingNavigate = null; // { view, url } — cross-domain redirect awaiting
 function getProxySession() {
   if (!proxySession) {
     proxySession = session.fromPartition('persist:proxy');
+    proxySession.setUserAgent(app.userAgentFallback);
     enableBlockingInSession(proxySession);
   }
   return proxySession;
@@ -118,6 +119,7 @@ function getProxySession() {
 function getDirectSession() {
   if (!directSession) {
     directSession = session.fromPartition('persist:direct');
+    directSession.setUserAgent(app.userAgentFallback);
     directSession.setProxy({ proxyRules: 'direct://' });
     enableBlockingInSession(directSession);
   }
@@ -981,6 +983,19 @@ ipcMain.on('action', (_event, action) => {
 // --- App lifecycle ---
 
 app.whenReady().then(async () => {
+  // Strip Electron/app tokens from User-Agent: Google blocks Electron's default UA
+  // with "Поддержка JavaScript отключена" on accounts.google.com. We keep the Chrome
+  // version Electron advertises (sufficient for modern features) but remove the
+  // Electron/X.X.X and ESH-Media/X.X.X identifiers.
+  const cleanUserAgent = app.userAgentFallback
+    .replace(/Electron\/[\d.]+\s*/g, '')
+    .replace(/ESH-Media\/[\d.]+\s*/g, '')
+    .replace(/\s+/g, ' ')
+    .trim();
+  console.log('[ua]', cleanUserAgent);
+  app.userAgentFallback = cleanUserAgent;
+  session.defaultSession.setUserAgent(cleanUserAgent);
+
   // Add Referer to image requests so hotlink protection doesn't block them
   session.defaultSession.webRequest.onBeforeSendHeaders(
     { urls: ['https://*/*', 'http://*/*'] },