fix: avoid Cloudflare 403 for urllib vision requests - #21

Problem

The shared Python vision client relied on urllib's default Python-urllib/3.x User-Agent. Cloudflare-backed OpenAI-compatible endpoints such as OpenCode Go can reject that signature with HTTP 403 / error code 1010 even when the same request, key, body, and model succeed with a browser-compatible User-Agent.

PR #13 also touches User-Agent behavior, but its current implementation hardcodes agent-vision-toolkit/0.1, provides no override, and is part of a broader Responses API change that still has requested changes. This PR is the minimal standalone bug fix for the confirmed 403 path; it does not duplicate the protocol or proxy features in #13.

Changes

• Send a browser-compatible User-Agent by default from vision_client.py.
• Allow providers and deployments to override it with VISION_USER_AGENT.
• Preserve API-key redaction for HTTP errors and extend the same redaction to terminal network errors.
• Test the exact default header, configured override, non-retry behavior for Cloudflare-style 403 responses, and HTTP/network error redaction.
• Document the optional setting in the environment template, bilingual configuration tables, install guide, and changelog.

Verification

Before the fix, a local fixture that rejects Python-urllib/* reproduced:

ua='Python-urllib/3.12'; Vision API HTTP 403: error code: 1010

After the fix, the same fixture returned ok with the configured browser-compatible default User-Agent.

Required repository checks passed:

• python3 -m py_compile vision_proxy.py vision_client.py ground.py detect.py bin/glance bin/trace bin/crop
• python3 tests/test_image_rewrite_shapes.py
• python3 tests/test_focus_hint.py
• python3 tests/test_anthropic_rewrite.py
• python3 tests/smoke_test_proxy.py
• python3 tests/test_vision_client.py
• git diff --check

This is a non-UI HTTP-client change, so there is no meaningful browser path; the substitute end-to-end verification is the local HTTP fixture exercising the affected User-Agent/403 request path.

Fixes #19