feat: switch Claude accounts instead of lending credentials

The previous helper moved the private account's OAuth token into the work
profile and had to be given back afterwards. Only the credentials moved, so
plugins and settings stayed behind, and a session that exited at the wrong
moment left the swap half-done.

An account is a whole profile directory here, and switching points
CLAUDE_CONFIG_DIR at another one of them. Nothing is copied, so nothing has to
be restored, and the plugins of an account come with it. A wrapper in
~/.local/bin makes the single `claude` command follow the switch, including
for the hooks and subprocesses a shell alias would never reach.

Each account also gets a Headroom proxy of its own -- its own port, its own
workspace, its own service -- because one shared proxy would collect the work
of both accounts in one cache. The router publishes them as
<account>.headroom.localhost, gives the bare domain to whichever account is
active, and keeps resolving the per-session names the enqs-jail plugin
publishes.

Status is a report rather than two lines: the parts of this setup fail
quietly, and a proxy that is not running, a wrapper that is shadowed or two
routers on one port are all invisible from a terminal.

install.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# Build the tool and put it in ~/.local/bin.
+#
+#   bash install.sh          build, link, and stop there
+#   bash install.sh --setup  also write the wrapper, the proxies and the router
+set -euo pipefail
+here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+cargo build --release --manifest-path "$here/Cargo.toml"
+mkdir -p "$HOME/.local/bin"
+ln -sf "$here/target/release/claude-account" "$HOME/.local/bin/claude-account"
+echo "Linked ~/.local/bin/claude-account -> $here/target/release/claude-account"
+if [ "${1:-}" = "--setup" ]; then
+	"$HOME/.local/bin/claude-account" setup
+else
+	echo "Run 'claude-account setup' to write the wrapper, the proxies and the router."
+fi