fix(oauth): isolate synthetic devices per account

[cls3389]

Summary

• Isolate Trae Web-only OAuth synthetic device credentials per account.
• Generate a new synthetic device identity for each OAuth login session and persist it after the final JWT uid is known.
• Match the pending synthetic identity by device_id during AuthCode exchange, because the final uid is not yet available at that stage.
• On successful OAuth, overwrite the account's device_map entry and synthetic device credential.
• On account deletion, remove both the device_map entry and the per-account synthetic device credential, so a fresh OAuth creates a new device.
• Keep the official ExchangeToken host allowlist from docker_main while using the per-account credential lookup.

Testing

• cargo check -p aiwork-core
• cargo test -p aiwork-core -- --test-threads=1
• cargo test --workspace
• npm test
• npx tsc --noEmit
• cargo build --release -p aiwork-server
• Docker restart + /health verified: {"running":true,"status":"ok"}