feat(sns): 支持外部分享卡片并增强媒体阶段识别

- 增强朋友圈 XML 解码与容错清洗，支持 bytes/hex/base64/zstd 场景。

- 补充外部分享(Type 5/42)字段提取与展示，新增 sourceName、链接卡片与导出渲染。

- 通过 Server-Timing + Timing-Allow-Origin 暴露 SNS 媒体阶段信息，前端改为从 ResourceTiming 读取，避免额外探测请求。

- 新增 XML 容错解析与 Server-Timing 注入测试。

src/wechat_decrypt_tool/api.py

@@ -5,6 +5,7 @@ from pathlib import Path
 
 from fastapi import FastAPI
 from fastapi.middleware.cors import CORSMiddleware
+from starlette.requests import Request
 from starlette.exceptions import HTTPException as StarletteHTTPException
 from starlette.responses import FileResponse
 from starlette.staticfiles import StaticFiles
@@ -25,6 +26,7 @@ from .routers.sns import router as _sns_router
 from .routers.sns_export import router as _sns_export_router
 from .routers.wechat_detection import router as _wechat_detection_router
 from .routers.wrapped import router as _wrapped_router
+from .sns_stage_timing import add_sns_stage_timing_headers
 from .wcdb_realtime import WCDB_REALTIME, shutdown as _wcdb_shutdown
 
 # 初始化日志系统
@@ -50,6 +52,28 @@ app.add_middleware(
     expose_headers=["X-SNS-Source", "X-SNS-Hit-Type", "X-SNS-X-Enc"],
 )
 
+
+@app.middleware("http")
+async def _add_sns_stage_timing_headers(request: Request, call_next):
+    """Expose SNS stage metadata to the frontend without extra requests.
+
+    `<img>` elements can't read response headers, but browsers can surface `Server-Timing`
+    via `performance.getEntriesByName(...).serverTiming` when `Timing-Allow-Origin` is set.
+    """
+
+    response = await call_next(request)
+    try:
+        add_sns_stage_timing_headers(
+            response.headers,
+            source=str(response.headers.get("X-SNS-Source") or ""),
+            hit_type=str(response.headers.get("X-SNS-Hit-Type") or ""),
+            x_enc=str(response.headers.get("X-SNS-X-Enc") or ""),
+        )
+    except Exception:
+        pass
+    return response
+
+
 app.include_router(_health_router)
 app.include_router(_wechat_detection_router)
 app.include_router(_decrypt_router)