Add guarded Proton account switching

[ClaudiuSchuster]

Summary

• add a distinct guarded Proton account-switch workflow with a complete native English/German login dialog
• block active transfers, queued uploads and Dirty VFS data before and after isolated candidate authentication
• activate a fresh anonymous cache namespace transactionally, retaining encrypted rollback data and restoring every live selector on failure
• document the access path, inputs, persistence, timing, rollback and data-safety behavior, with privacy-safe Broadway screenshots

Safety

• credentials use one anonymous NUL-delimited stdin pipe and never enter argv, environment variables, logs, fixtures or diagnostics
• same-account reauthorization and its rate-limit lifecycle stay separate; both authentication transactions share only a serialization lock
• legacy and account-specific cache roots are never merged, reassigned or deleted
• no live Proton account, mount, transfer, cache or remote data was used by the automated validation

Validation

• make check
• git diff --check
• isolated Broadway GTK widget checks in English and German
• Super-Linter 8.7.0, including ShellCheck, Ruff, Markdown/Prettier, Gitleaks and Actions checks
• visual inspection of both new documentation screenshots

Closes #58