fix: persist refreshed Claude account tokens

[jacobcxdev]

Summary

• persist refreshed Claude tokens to cq-managed keyring even when the active Claude credentials file is missing or belongs to a different account
• prevent active credential overwrites when stable account identifiers conflict
• add regression coverage for secondary-account refresh persistence and active credential updates

Test plan

• go test -race -count=1 ./internal/keyring
• go vet ./...
• go test -race -count=1 ./...
• go test -race -count=1 ./internal/keyring ./cmd/cq ./internal/provider/claude ./internal/proxy