perf(auth-files): scope credential refresh lookups

[camy-x]

Summary

Single Codex credential refresh currently fetches the complete auth-file inventory for its preflight and every polling attempt. Scope those reads to the affected physical source and credential identity, then reconcile only that source back into the complete local Accounts inventory.

This is a bounded CPAMP 1.x optimization related to #804. It does not change Accounts loading, search, filtering, sorting, metrics, pagination, selection, deletion, or batch-operation semantics.

Scope

• Frontend panel
• Manager Server
• CPA panel mode
• Full Docker mode
• Native packages / release
• Docs / Wiki
• CI / build / tooling

Changes

• Add a scoped auth-file lookup that sends CPA's existing name / auth_index filters and filters locally as a compatibility guard when an older CPA ignores them.
• Refresh one credential using source and runtime-identity lookups, preserving shared-source membership and cross-source collision checks before mutation.
• Poll only the target credential, perform a final source/identity verification, and replace only the affected source in local state so unrelated accounts remain intact.

User Impact

Refreshing one Codex credential no longer repeatedly transfers and normalizes the complete credential pool on CPA versions that support filtered auth-file reads. Initial Accounts loading and every global Accounts behavior remain unchanged.

Compatibility / Runtime Notes

• CPA panel mode: Uses the existing CPA /auth-files?name=...&auth_index=... contract. Local filtering keeps the lookup semantically scoped if an older CPA returns an unfiltered response.
• Manager Server mode: Uses the same existing compatibility path and does not add a Manager API.
• Full Docker / native packages: No configuration, storage, or deployment changes.

Data / Security Notes

No credential contents or tokens are added to requests or logs. Lookups carry only the existing physical/runtime selector and optional auth_index. Source membership, account identity, and runtime-ID collision checks remain fail-closed before the refresh mutation.

Risk / Rollback

Risk level: Medium

Rollback notes: Revert a2646e91 to restore full-list preflight and polling.

Verification

• Type check
• Lint
• Tests
• Build
• Manual UI check
• Docs/link check
• Not applicable, docs-only

Commands / evidence:

tsc --noEmit
eslint src/services/api/authFiles.ts src/services/api/authFiles.test.ts src/features/authFiles/hooks/useAuthFilesData.ts src/features/authFiles/hooks/useAuthFilesData.test.ts --report-unused-disable-directives
vitest run src/services/api/authFiles.test.ts src/features/authFiles/hooks/useAuthFilesData.test.ts  # 162 passed
vitest run src  # 239 files, 3660 tests passed
vite build

Screenshots / Recordings

N/A — no visible UI change.

Docs

• README / README_CN updated for user-visible capabilities
• Matching docs manual and navigation updated
• Demo fixtures, screenshots, and deep links reviewed
• Release notes needed
• Not needed — explanation included below

Docs decision: Internal request/reconciliation optimization only; no new user-facing capability, configuration, route, or workflow.

Related

Refs #804
Depends on the filtered lookup contract already available in CPA; router-for-me/CLIProxyAPI#5897 remains useful for transport compatibility and future Manager-side query work but is not used as Accounts pagination here.