fix: keep newly added accounts inactive

[legibet]

Summary

• Keep newly added OAuth accounts inactive.
• Preserve active_account_id when adding an account, including the first account.
• Add one storage regression test covering empty and active stores.

Why

OAuth completion currently writes the new account directly to ~/.codex/auth.json. This bypasses the process guard and token-preservation flow used by Switch.

After this change, adding an account only stores it. The user activates it through the existing Switch action.

Checks

• cargo test --manifest-path src-tauri/Cargo.toml: 51 passed
• cargo clippy --manifest-path src-tauri/Cargo.toml --all-targets: completed with pre-existing warnings
• pnpm build: passed
• pnpm test:reset-credits: 3 passed
• git diff --check: passed

Related

• Fixes OAuth login bypasses safe account switching when adding an account #140
• Implements the focused account-add behavior also proposed in feat: multi-instance management and architecture patterns upgrade #61