fix(dashboard): show effective egress on no-auth account card

[maxmad64bis]

Summary

• The no-auth card labeled any proxyless account "Direct (no proxy)", so users on a proxied or pooled connection saw direct egress while traffic inherited the connection's assignment.
• The card rendered only the account's own proxy and never consulted the connection-level assignment list (GET /api/settings/proxies/assignments, list mode only — never the mutating resolve endpoints).
• The card now derives a pure effective-egress value (own, inherited proxy, inherited pool by count, fail-closed empty pool, or direct only when nothing applies) for shield title/aria and selector option, with five new noAuthProvider keys in en/vi; execution unchanged.

Related Issues

• No linked issue — self-contained UI display fix; read-only, no behavior change.

Validation

• Change type: UI, i18n
• Focused tests and category gates from the golden path
• npm run lint
• Reconciled with the current active release base; focused checks rerun afterward
• Production-code changes include a new or updated automated test in this PR

Tests Added Or Updated

• tests/unit/ui/noauth-effective-egress.test.tsx (new): 10 pure getEffectiveEgress cases (inherited proxy/pool-by-count, direct, pool-empty fail-closed, proxy-off-first, orphan proxyId, legacy fallback, provider→global precedence) + 3 render cases (inherited shield title, renamed empty option, pool-empty never direct); RED 13 failed before, GREEN 13 after.
• tests/unit/ui/noauth-account-card.test.tsx unchanged green (8/8); tests/unit/7993-noauth-proxy-routing.test.ts + dashboard-localization-contract.test.ts green (16 passed, 0 failed); i18n: 67 locales, 0 __MISSING__ in vi.json.

Coverage Notes

• The new getEffectiveEgress derivation plus shield/select branches are covered by the 13-case suite (all kinds plus proxy-off/orphan/legacy/combo edges).
• No coverage decrease expected: all existing suites stay green, untouched behavior keeps its coverage.

Reviewer Notes

• Assignments are read in list mode only — the resolveConnectionId/?resolve= endpoints are forbidden for display because they advance rotation cursors server-side.
• proxyEnabled=false wins first; otherwise inheritance is assumed when the flag is absent.
• A pool renders by count only, never a picked member; an empty pool renders fail-closed, never direct (registry rows only).

Maintainer rework (merge-batch 2026-09-24)

• Merged the current release/v3.8.51 tip into the branch (clean merge, author commit preserved).
• getEffectiveEgress: a combo-scope assignment only applies to requests routed through that combo, so a combo row alone no longer puts the account in pool-empty ("Pool empty, requests fail"). When no account, provider or global level decides the egress, a combo row now returns null (not affirmable). The card then keeps the neutral legacy shield and claims neither direct nor pool-empty. No new i18n keys.
• Tests: the two combo unit tests now expect null, and a new render test checks that a combo-only setup shows the neutral "Configure proxy" shield without the red pool-empty styling. All three fail on the previous head and pass with the fix.