feat: auto-disable accounts on expired/revoked auth

- Detect auth failure (HTTP 401/403, invalid token, login expired)
  during token refresh and upstream requests
- Disable the account from round-robin scheduling immediately,
  delete its credential file, and write a persistent .disabled marker
- status/runServe console shows disabled accounts with reason and
  re-login command; re-login clears the marker and restores scheduling
- Background refresher skips disabled accounts; refresh command reports
  skipped count
- Unit tests for auth-failure detection, disabled skip, marker
  persistence/restore/clear

.gitignore

@@ -5,6 +5,8 @@ dist/workbuddy.json
 dist/*.json
 last-*.json
 *.json.bak
+*.json.disabled
+.workbuddy-*.json
 
 # 本地编译产物
 workbuddy-gateway.exe