feat: add FDE presets and managed account proxy support

[python-rust]

Scope and rationale / 范围与原因

This PR delivers the 2026-09-16 branch work and converges its durable Trellis contracts:

• add 30 China-market FDE prompt presets and an exact 20-entry FDE MCP catalogue;
• reuse explicitly selected OpenAI/xAI managed accounts through FyAgent's local proxy for Claude Code, Codex, and Grok Build;
• prefer the current SwiftPM privileged-helper product over a leftover Xcode product;
• keep an idle managed proxy overview parseable;
• split the managed-account proxy binding/overview contract out of Managed Auth core and give the generic frontend subscription workflow a semantic owner.

The implementation audit found no additional runtime defect beyond the already committed behavior fixes. The final audit commit freezes exact catalogue membership and removes overlapping SPEC ownership rather than adding another state machine.

Out of scope: new providers/targets/protocols, public gateway deployment, database schema changes, real-account entitlement claims, or privileged-helper installation changes.

Related work / 关联工作

Issue / planning context (if applicable):

• .trellis/tasks/archive/2026-09/09-16-fde-china-presets/
• .trellis/tasks/archive/2026-09/09-16-managed-account-proxy/
• .trellis/tasks/archive/2026-09/09-16-review-todays-specs-and-merge/

Evidence / 验证证据

• Local gate / 本地门禁: TRELLIS_CONTEXT_ID=fyagent-review-20260916-specs mise run check:prearchive --exclude-active-task .trellis/tasks/09-16-review-todays-specs-and-merge — exit 0.
• Focused checks / 聚焦检查:
  • mise run test:unit -- tests/renderer/pages/prompts/presets.test.ts tests/renderer/features/mcpCatalog.test.ts tests/miseTaskContract.test.ts — 64 passed, 1 repository-declared skip.
  • Full Vitest run inside the gate — 189 files, 1713 passed, 1 repository-declared skip.
  • Rust main library — 3264 passed, 5 explicitly ignored; all executed integration/helper/doc-test targets passed.
  • mise run typecheck, lint, formatting, Rust fmt/check/clippy, release/platform/task contracts — passed.
  • Post-archive mise run check:contracts — 619 passed, 1 repository-declared skip; native-fetch 4 passed.
• Native or remote evidence / 原生或远程证据: macOS arm64 local build/test evidence; exact pushed head is ada2dc988a664713c160ea8cdcf9f66b69d152f6. GitHub PR and merge-group CI / Required remain the hosted authorities.
• Not verified / 未验证: no real OpenAI/xAI subscription login, entitlement/quota call, signed privileged-helper install/HIL, or Windows desktop HIL was run. Synthetic IPC, fake vault, and loopback upstream fixtures do not claim those facts.

Risk and rollback / 风险与回退

• User-visible risk is limited to the new FDE catalogue and managed subscription target flow. Existing native Agent auth, MCP/permission fields, and unrelated target configuration are preserved by transactional readback/rollback tests.
• OAuth material remains in the Managed Auth SecretRef/vault path; Provider rows, Agent live files, renderer DTOs, Change Plans, logs, and errors remain secret-negative.
• No database migration or release asset format changes are introduced.
• Narrow rollback is to revert the relevant behavior commit(s); the final SPEC/test audit commit can be reverted independently without mutating user data.

Contract and provenance impact / 契约与来源影响

• Durable behavior changes update executable tests and maintained docs, or
  this PR explains why none changed / 长期行为已更新可执行测试与维护中文档，或已说明无需修改
• Upstream changes record tag, tag object/peeled commit, merge/conflict
  decisions, and preserved FyAgent contracts, or are not applicable /
  上游变更已记录 tag、SHA、merge/冲突与 FyAgent 契约，或不适用（本 PR 不含上游同步）
• CI/Release changes record triggers, permissions, runner/platform evidence,
  exact assets, remaining remote gates, and rollback, or are not applicable /
  CI/Release 变更已记录触发、权限、平台、资产、远程门禁与回退，或不适用（仅调整 helper 构建产物选择）

Screenshots / 截图

Not applicable to the final SPEC/test audit. The feature tasks retain their browser evidence; no screenshot is presented as native-file or real-subscription proof.

Checklist / 检查清单

• Complete current-host prearchive gate passes / 当前宿主完整归档前门禁通过
• Tests cover observable success and failure behavior / 测试覆盖可观察成功与失败路径
• Locale-owned copy is unchanged; China-market catalogue text is intentional domain data / locale 管理文案未变，中国市场目录文字属于有意的领域数据
• No secret, certificate, personal config, .venv, or user data is included / 未包含 secret、证书、个人配置、.venv 或用户数据
• Claims distinguish local checks from native runners and published Release evidence / 结论明确区分本地检查、原生 runner 与正式发布证据