fix: deduplicate imported accounts after token rotation

[zyxtoworld]

Summary

• deduplicate account imports by stable identity instead of the full access-token string
• prefer chatgpt_account_id so separate workspaces remain separate, with subject/email fallbacks only when the account ID is absent
• keep the longest-lived token, preserve existing account metadata and creation time, and migrate token aliases plus image in-flight state
• resolve token aliases before batch refresh so one imported account is not refreshed multiple times

Root cause

All account import paths converge on AccountService._add_account_payloads:

• CPA
• Sub2API
• manual token/JSON import
• OAuth login

The shared method only deduplicated exact access-token strings. A refreshed token therefore created a second pool entry for the same ChatGPT account, and the subsequent refresh phase also requested that account twice.

Tests

• regression-first check on upstream main: 7 of 8 new behavior tests failed before the fix
• 25 focused account/export/capability tests pass
• JSON and SQLite persistence both retain only the replacement token after reload
• 140 offline tests across 21 isolated modules pass
• a 1,577-token synthetic import matching the reported pool shape produces 1,507 unique accounts and 70 skipped duplicates

Baseline note: five unrelated image tests fail identically on unmodified upstream commit e55aef2 and this branch; they were excluded from the isolated 140-test pass set.