fix: serialize account store updates

[demetrius-skypulse]

Fixes #100.

Summary

• route every accounts.json mutation through one bounded, guard-owned worker
• persist updates with same-directory atomic replacement instead of concurrent fs::write calls
• keep disk I/O off the UI/runtime thread and publish read-only in-memory snapshots
• serialize account selection and active-account token refresh so stale refresh state cannot overwrite auth.json
• close update admission and drain accepted writes during desktop or standalone web shutdown

Why

The Refresh flow launches concurrent metadata and token updates. Each update previously performed its own load-modify-write sequence against accounts.json, so writes could race and leave valid JSON followed by a stale duplicated suffix. That makes subsequent refreshes fail with Failed to parse accounts file.

The same stale-state pattern also allowed an in-flight token refresh to rewrite ~/.codex/auth.json for an account that was no longer active.

Scope

This keeps the existing desktop and optional codex-web entrypoints. Each gets the same single-writer behavior when run independently. Coordinating simultaneous desktop and web processes is intentionally out of scope for this fix.

Validation

• cargo check --manifest-path src-tauri/Cargo.toml
• cargo test --manifest-path src-tauri/Cargo.toml (37 passed)
• cargo clippy --manifest-path src-tauri/Cargo.toml --all-targets (passes with existing warnings)
• pnpm build
• pnpm tauri build --bundles app --config '{"bundle":{"createUpdaterArtifacts":false}}'
• git diff --check

New tests exercise concurrent account updates and confirm mutations execute on the dedicated worker thread.