feat(experts): refine clinical source verification

[Pandakingxbc]

Summary

• expand clinical source roles from primary/B+ only to S/A, B+, B, B-, C, and D
• separate document selection from retrieval carrier selection, with China-first guidance
• require document-level Exact/Strong identity checks before using B+/B full-text carriers
• integrate the existing medical-source-failover ladder without lowering evidence standards
• strengthen output validation and tests for carrier metadata, content type, and domain roles

Verification

• tests/unit/agents/test_clinical_learning_subscription_template.py: 38 passed
• Ruff passed
• mypy passed (443 source files)
• full suite: 2501 passed, 46 skipped, with 3 known unrelated develop baseline tests excluded
• Dashboard production build passed

Known develop baseline failures

• tests/integration/test_subagents_api.py::test_catalog_divisions expects 16 divisions, current catalog has 19
• tests/unit/agents/test_subagent_catalog.py::test_bundled_library_non_empty expects 16 divisions, current catalog has 19
• tests/unit/browser/test_browser_setup.py::test_ensure_chrome_runtime_env_forces_tmp_dir hardcodes /tmp, while macOS resolves its temporary directory under /var/folders/...

These paths are unchanged by this PR.