feat: isolate account-bound proxy leases

[chenyme]

Closes #878.

Summary

• Detect account-bound proxy templates containing {account} and treat each account/node pair as an independent egress lease.
• Quarantine only the anomalous account lease instead of disabling the entire shared node.
• Pin recovery probes to the same account and node, with CAS-protected restoration.
• Add durable lease storage, keyset pagination, bounded recovery processing, and exponential backoff.
• Automatically remove stale leases when accounts or nodes are disabled, rebound, reauthenticated, or reconfigured.
• Expose lease counts and diagnostic events in Quality Guard, including account ID, request ID, reason, and expiry.

Safety

• Ordinary fixed-proxy nodes keep the existing node-level Quality Guard behavior.
• Shared {account} nodes are never disabled because one account lease degraded.
• Expired lease blocks stop affecting routing if the sidecar is unavailable.
• Recovery performs only one physical attempt against the pinned account and proxy identity.
• Stale recovery probes cannot clear a newer quarantine because restoration requires the matching lease version.
• Rendered proxy usernames, proxy URLs, and credentials are never exposed through the lease API.
• Invalid or non-advancing pagination cursors fail safely.

Scalability

• Lease reconciliation scans the complete durable set using opaque keyset pagination.
• Recovery is limited to eight leases per cycle.
• Failed recoveries retry with exponential backoff from 30 seconds to 30 minutes.
• Disabled, invalid, or reconfigured account/node leases are pruned automatically.

Validation

• go test ./... -count=1
• python3 -m unittest discover -s tools/egress-quality-guard -p 'quality_guard_test.py' — 57 passed
• cd frontend && pnpm test — 9 passed
• cd frontend && pnpm lint
• cd frontend && pnpm build
• git diff --check

Not tested

A live end-to-end test against an actual 1024Proxy/Resin deployment was not performed.