feat(services): expose sanitized CLIProxyAPI account health

[RaviTharuma]

Summary

• query CLIProxyAPI GET /v0/management/auth-files through a 5-second timeout-bounded, read-only client
• expose only an explicit health allowlist through an OmniRoute management-authenticated API
• show account state and aggregate success/failure counts in the existing CLIProxyAPI service tab
• provision embedded CLIProxyAPI management auth from OmniRoute's encrypted service key; require CLIPROXYAPI_MANAGEMENT_KEY for external instances
• document the external management-key contract in .env.example and the environment reference

The response intentionally excludes names, filesystem paths, email/account identifiers, tokens, status messages, raw metadata, and every unknown upstream field. This is visibility only: account attribution and per-account routing remain blocked by CLIProxyAPI's current data-plane contract and are tracked separately in #6340.

Closes #6342
Related #6340

• Focused tests and category gates from the golden path

Tests Added Or Updated

• client contract: allowlist redaction, management auth, timeout, and disabled/missing/unreachable/unauthorized/unsupported/invalid response states
• API contract: OmniRoute management authentication and no-store response
• embedded service: management password injection without config-file persistence
• dashboard: CLIProxyAPI tab exports and mounts the read-only account card

Verification

• focused Node test run: 16/16 passed after rebase
• focused ESLint: passed after rebase
• npm run check:env-doc-sync: passed
• git diff --check: passed
• full tsc --noEmit: attempted; blocked by pre-existing errors in tray typings, stream Transformer cancel typings, and an unrelated ad-hoc script

[RaviTharuma]

Implementation evidence:

• rebased onto current release/v3.8.50 (ac02c5b42)
• 16 focused client/API/service/UI tests pass
• focused ESLint and env-doc sync pass
• PR is mergeable; required CI is running

Security boundary: the OmniRoute response is constructed from a strict allowlist and never forwards CPA names, paths, email/account identifiers, tokens, status messages, raw metadata, or unknown fields. The management secret is only sent server-to-server and is never returned.