feat: isolate upstream connection pools by account

[chenyme]

Follow-up hardening

• preserves HTTP_PROXY and HTTPS_PROXY behavior when Grok Build uses account-isolated direct connection pools
• keeps the existing process-wide Build fallback transport when account isolation is disabled
• makes connection-isolation mode changes atomic with client-cache invalidation
• revalidates the isolation mode during client creation and rebuilds cache keys after concurrent hot updates
• prevents stale shared or isolated clients from being inserted after a configuration transition
• preserves config.yaml values when upgrading from an older persisted runtime-settings payload that does not contain accountIsolatedConnections
• distinguishes an omitted setting from an explicit false in both persisted settings and management API requests
• documents the additional connection, TLS, memory, and file-descriptor cost for large account pools

Compatibility

• account connection isolation remains disabled by default
• existing deployments retain their original shared connection-pool behavior
• explicit runtime settings continue to override config.yaml
• older runtime-settings payloads no longer silently disable a newly configured YAML value
• the same account continues to reuse its own connection pool when isolation is enabled
• Grok Build, Grok Web, Grok Console, and Web-to-Build conversion paths remain supported

Validation

• go test ./... -count=1
• go test -race ./internal/infra/egress ./internal/infra/provider/cli ./internal/application/settings ./internal/transport/http/settings -count=1
• go vet ./...
• pnpm lint
• pnpm build
• git diff --check