fix: validate duplicate OAuth sessions before replacement

[Bl0ck154]

When re-adding an account with the same name, Codex Switcher currently rejects the duplicate outright. This PR makes duplicate replacement safer and more useful.

Behavior:

• if the existing saved OAuth session is stale, replace it automatically without prompting;
• if the existing session is genuinely still usable, ask for confirmation before overwriting it;
• validate the existing session by performing a one-time refresh-token check, even if its current access token has not expired yet;
• treat terminal refresh failures such as refresh_token_invalidated, refresh_token_reused, or Your session has ended as a stale saved session;
• transient/unknown refresh failures remain conservative and require confirmation;
• if two accounts share a display name but have different known ChatGPT account IDs, never replace silently;
• preserve the existing internal account ID, creation time, and last-used history when credentials are replaced;
• OAuth credentials are staged while the confirmation dialog is shown, so confirming does not require another browser login;
• the same replacement flow works for imported auth.json credentials.

Validation:

• frontend production build passes (tsc && vite build);
• Rust test suite on the clean upstream branch passes: 46 passed, 0 failed;
• branch is one commit directly on top of current upstream main with no version/release changes.