refactor(accounts): split account-service.ts into 12 focused modules (N2)

[NagyVikt]

Implements Theme N2 from the 0–4 weeks Now horizon. Splits the 1,675-LOC src/lib/accounts/account-service.ts god-file into 12 focused modules per docs/future/01-ARCHITECTURE.md §2.1. Branches off the wave-1 head (N1 #29, N3 #28, N4 #27 already merged).

Exit criteria (verbatim from 17-ROADMAP.md)

• At least eight of the ten target modules listed in 01-ARCHITECTURE.md §2.1 exist. All 12 land (table has 12 rows; floor was 8).
• account-service.ts is below 400 LOC. 1,675 → 164 LOC (close to the ~150 orchestrator goal).
• No public method signature on AccountService changes; the singleton in src/lib/accounts/index.ts still works. All 21 public methods preserved; verified by node -e "..." probe and by BaseCommand.accounts continuing to compile.
• Each extracted module has at least one unit test. 31 new test cases across 3 files cover every cluster.
• CI passes on Linux and macOS (Windows matrix included).

Extracted modules (post-split LOC)

Module	LOC	Cluster
sync/external-sync.ts	216	external-auth sync orchestrator
read/listing.ts	211	listings + getCurrentAccountName + find
write/save.ts	159	saveAccount + safety guard + name inference
write/use.ts	128	useAccount + activateSnapshot + resolveUsableAccountName
write/remove.ts	105	remove one / by-query / all
config/auto-switch-config.ts	82	status + threshold setters + api-usage toggle
auto-switch/policy.ts	141	runAutoSwitchOnce + runDaemon + candidate scoring
usage/adapter.ts	192	refreshAccountUsage + refreshListUsageIfNeeded + proxy shim
safety/snapshot-vault.ts	125	backup vault + clobber recovery
session/pin.ts	243	sessions.json I/O + Linux PPID heuristic
identity/equality.ts	86	snapshot identity comparisons (pure, no I/O)
naming.ts	40	normalizeAccountName + accountFilePath + percent guard

Shared helpers under _internal/ (not part of the public surface):

• _internal/fs-helpers.ts (64) — pathExists / filesMatch / auth-state read
• _internal/auth-state.ts (70) — symlink materialize + current-name file I/O
• _internal/registry-ops.ts (50) — persistRegistry + metadata hydration
• _internal/name-resolution.ts (196) — login/default/inferred name resolution

Orchestrator account-service.ts: 164 LOC. Every public method delegates to a free function in one of the cluster modules.

Behavior guarantees

• Byte-identical behavior. All 98 pre-N2 tests still pass. 31 new tests added — 129 total, 0 failing.
• N1 contract honored. Every write still routes through persistRegistryAtomic / secureWriteFile.
• N3 contract honored. Errors still throw AuthmuxError subclasses with the same codes/severity/hints.
• N4 contract honored. Path resolution stays per-call via resolveCodexDir() / resolveAccountsDir() / etc; no module-import-time path resolution introduced.
• Public consumers unchanged. commands/check.ts, commands/forecast.ts, commands/auto-switch.ts, and the two test files that import AccountService directly compile without edits.

Verification

npm run build               → clean (tsc -p tsconfig.json, Node16)
npm test                    → tests 129, pass 129, fail 0
wc -l account-service.ts    → 164 (< 400 ceiling)
find … | wc -l (total)      → 3842 across all accounts/*.ts
singleton probe             → all 21 methods are functions
node dist/index.js --help   → CLI boots, all 26 commands listed

Notes for reviewers

• Diff looks large because the entire 1,675-LOC file is deleted and re-emitted as the orchestrator. Most "additions" are the 16 new module files. Original behavior survives line-for-line — comments preserved where they explained crash-safety rationale.
• read/listing.ts and write/use.ts take a getCurrentAccountName thunk to break a potential cycle through sync/external-sync.ts. The orchestrator wires them with () => this.getCurrentAccountName().
• The usage/ directory deliberately sits next to the existing usage.ts (660 LOC). That file is the next refactor target (X2 in the roadmap); this PR does not touch it.
• git mv was not used because every new module also has different content; preserving blame would require keeping the old file in place. The original was deleted and the orchestrator rewritten — historical blame is reachable via git log --follow on the deleted lines.

🤖 Generated with Claude Code