fix: bootstrap ClientTransaction from responsive home

[LuciusChen]

Summary

• fetch https://x.com/home when bootstrapping ClientTransaction
• keep auth cookies out of the HTML bootstrap request
• add a regression test covering the responsive home URL, ondemand bundle lookup, feature refresh, and cache write

The root path now serves a lightweight logged-out shell without the ondemand.s bundle. The responsive home path still exposes the assets required to generate x-client-transaction-id, which SearchTimeline requires.

This supersedes the closed #71 with the narrower path-only fix discussed there.

Fixes #69.
Fixes #73.

Validation

• 243 passed, 6 deselected
• ruff check .
• mypy twitter_cli

[bakemocho]

Independent reproduction and one datum that may help decide between this PR and #79.

As of 2026-08-03, https://x.com (root) returns a minimal shell page (~34KB, no script tags, no ondemand.s reference) to non-browser clients, which makes get_ondemand_file_url() fail with 'NoneType' object has no attribute 'group'. Writes then go out without x-client-transaction-id and X rejects them with a misleading error 344: You have reached your daily limit for sending Tweets and messages (no real limit was hit; reads keep working).

Measured with the same curl_cffi Chrome-fingerprint session the CLI uses:

Fetch	Size	contains ondemand.s
https://x.com (no cookies)	~34KB	no
https://x.com/home (no cookies)	~274KB	yes
https://x.com/home (auth cookies)	~276KB	yes

Anonymous /home still serves the full manifest, so this PR's URL-only change is sufficient and sending auth cookies (#79) is not strictly required for CT init.

Applied this patch locally: CT init succeeds, transaction IDs generate, and a live post went through on the first try with the 344 error gone. Also fixes the symptoms in #69, #73, and #78.