feat: migrate rate limits to account card identity

[linhay]

Summary

• Make account card id/account_key the only rate-limit identity and remove match_key from GetTokens DTOs/UI.
• Wire account detail rate-limit CRUD through page-shell injection so browser preview never calls Wails bindings directly.
• Document the account-card identity model and runtime smoke evidence.

Sidecar dependency: AxApp/CLIProxyAPI@gettokens/sidecar includes 3837f0a3.

Verification

• go test ./internal/config ./internal/watcher/synthesizer ./internal/gettokenshooks ./internal/runtime/executor/helps ./sdk/cliproxy/usage ./sdk/cliproxy/auth ./internal/api/handlers/management (sidecar)
• go test ./internal/sidecar ./internal/cliproxyapi ./internal/wailsapp
• npm --prefix frontend run test:unit
• npm --prefix frontend run typecheck
• npm --prefix frontend run build
• CLI_PROXY_SOURCE_DIR=/Users/linhey/Desktop/linhay-open-sources/CLIProxyAPI-worktrees/20260529-account-card-identity-migration ./scripts/wails-cli.sh build
• dev sidecar runtime smoke: /healthz, strategies/create/status/events/delete/list all 200
• playwright-cli preview smoke for account detail rate-limit summary/config states

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.