feat(rpc): key Tooling Access JWT cache by account (DX-6130)

[johnpmitsch]

Summary

• Keys the qn rpc Tooling Access token cache by account id instead of by API-key hash. Tooling Access endpoints are per-account, so all API keys for one account now share a single cached JWT rather than re-minting per key.
• Two-level offline lookup in tokens.toml: sha256(api_key) -> account_id -> token. A cache hit resolves the account offline (no control-plane call); a miss learns the account id from account_info once, alongside the mint that already happens.
• Per-account entries with read-modify-write save/delete, so one account's stale token never disturbs another's. An older on-disk schema is treated as a cache miss and rewritten in place. The custom-endpoint lane is unchanged.

Closes DX-6130

Test plan

• Two API keys for one account share a cached JWT (no second mint)
• Cache hit performs zero account_info and zero mint calls
• Cache miss on a new key calls account_info exactly once, then caches the mapping
• Per-account stale-token clear leaves other accounts' tokens and key mappings intact
• Old-schema tokens.toml is a miss, not an error, and is rewritten
• Custom-endpoint calls never touch the cache
• tokens.toml is 0600 and never contains the API key
• cargo test, cargo clippy --all-targets -- -D warnings, cargo fmt --check, cargo build --release all pass