feat(qs): PC 签名改双模式供给，签名工具链迁出独立仓库 qs-signer

- mssdk.ts：进程内 bdms.node 加载移除；优先 QS_SIGN_SERVER 调签名服务
  （兼容 qs-signer 仓库 server.mjs 与 mssdk-sign 两个实现，/sign 契约互通），
  无服务时 QS_HELIOS/QS_MEDUSA 或 data/qs-sign.json 固定值兜底，都没有走安卓自签
- musicSearch：PC 通道签名失败/请求异常/风控空结果自动降级安卓通道（原为同通道重试）
- signer/、tools/mssdk-sign/、scripts/qs-local-login.mjs 迁至 qs-signer
  （gitea.4i.hk/hhhge/qs-signer），soda-mssdk/ 二进制目录一并挪走

sdk/apis/qs.ts

@@ -8,7 +8,7 @@
 // 统一接口约定：apis('qs').getMusicUrl(songInfo, type) → { promise, cancelHttp }
 // promise resolve → { type, url }
 
-import { httpFetch } from '../request.ts'
+import { httpFetch } from '../common/request.ts'
 import { createHash, randomBytes } from 'node:crypto'
 import musicInfo from '../qs/musicInfo.ts'
 import { getDevice } from '../qs/device.ts'
@@ -156,10 +156,10 @@ const fetchTrackPlayerByApp = async (trackId: string) => {
   }, requestBody)
 }
 
-// 通道 B（降级）：官方 PC 客户端签名 X-Helios/X-Medusa（需 sdk/qs/mssdk.ts 的签名模块）
+// 通道 B（降级）：官方 PC 客户端签名 X-Helios/X-Medusa（签名服务器或固定值，见 sdk/qs/mssdk.ts）
 const fetchTrackPlayerByPc = async (trackId: string) => {
   const sessionId = getSessionId()
-  if (!mssdkAvailable()) throw new Error('官方签名模块不可用')
+  if (!mssdkAvailable()) throw new Error('PC 签名不可用')
   const url = `${TRACK_V2_URL}?${new URLSearchParams(pcCommonParams()).toString()}`
   const requestBody = TRACK_V2_BODY(trackId)
   const headers: Record<string, string> = {
@@ -172,7 +172,7 @@ const fetchTrackPlayerByPc = async (trackId: string) => {
     'x-ss-stub': createHash('md5').update(requestBody).digest('hex').toUpperCase(),
     ...(sessionId ? { cookie: getCookie() || `sessionid=${sessionId}` } : {}),
   }
-  const signed = signQishuiRequest(url, headers)
+  const signed = await signQishuiRequest(url, headers, requestBody)
   if (!signed) throw new Error('官方签名失败')
   return fetchTrackPlayer(url, { ...headers, ...signed }, requestBody)
 }