feat: add isolated multi-account metering and device switching

[Y1hsiaochunnn]

📝 Summary

• Add up to four isolated Codex account profiles, each with its own CODEX_HOME and cached login.
• Poll accounts serially with round-robin scheduling and per-account backoff, then expose one additive account list to the dashboard and device transports.
• Add account switching to the loopback dashboard and ESP32 firmware while preserving the existing top-level v1 compatibility mirror.
• Display the validated full account email by default, with an explicit short -Label alias available for privacy-sensitive deployments.
• Move enlarged transport buffers and NimBLE host allocations to PSRAM so BLE remains reliable with multi-account snapshots.
• Include a separate Windows reliability commit for hidden autostart shell selection and runtime signature verification.

🧩 Scope

• Windows / Node host
• Python BLE helper compatibility
• Device firmware, BSP, and Kconfig
• LVGL / SDL UI
• Documentation

🔍 Problem and approach

The host previously followed one mutable Codex credential cache, so signing in to another account replaced the only identity visible to the meter. The new account registry creates isolated login homes and reconciles them on each global scheduling tick. Initial profiles warm serially; steady state polls at most one due profile per tick, avoiding a burst of concurrent account requests.

The host sends a bounded additive accounts[] list while retaining the original top-level v1 fields for compatibility. The firmware keeps selection by stable profile ID, ignores account controls when only one account exists, and renders the selected identity on both pages. GPIO18 uses short press for next and long press for previous; an independent external GPIO0 button remains opt-in because the reference board's onboard GPIO0 key also affects CHIP_PU.

🔄 Compatibility and user impact

• Hosts without explicit profiles continue to use the existing default CODEX_HOME as a one-account fallback.
• Existing firmware can continue reading the top-level v1 mirror and ignore the additive list.
• New firmware accepts zero to four account entries and preserves the selected profile across refreshes and reordering.
• The device label is bounded to 64 printable ASCII bytes to match its fixed buffer and the BLE stream budget; longer identities require an explicit short alias instead of silent truncation.
• Four maximum-size account labels remain within the authenticated BLE JSON limit.

✅ Verification

• npm test — 91/91 passed
• npm run test:docs — 14 bilingual files passed
• Python BLE tests — 18/18 passed
• Firmware host tests — 7/7 passed
• PowerShell AST parsing for the affected scripts
• node --check public/app.js
• SDL simulator build and visual review of overview/details with synthetic example.com accounts
• ESP-IDF v5.5.5 complete ESP32-S3 target build with external build/config paths; application partition remains 79% free
• Reference ESP32-S3 device validation for BLE startup, advertising, MTU 256, host reconnection, and authenticated GATT acknowledgement
• git diff --check

The final privacy-only serial-log change was rebuilt after hardware validation; it removes identity text without changing the transport or selection path.

🖼️ Screenshots and compatibility

Deterministic SDL overview and details screenshots were reviewed locally with synthetic account addresses. Generated screenshots are intentionally not committed. The shared production meter_ui.c source is used by both SDL and the device firmware.

🔐 Security checklist

• No passwords, pairing tokens, host.json, OAuth data, cookies, private logs, local paths, device identifiers, or local runtimes are committed
• Added ignore rules and regression coverage for auth.json and local accounts/ registries
• Exact-match checks found no current local credential, host identity, or account email in added lines
• All committed email literals use synthetic example.com / example.org fixtures
• Account and upstream error text is bounded, control-character filtered, and rendered with textContent
• Firmware account-selection logs contain only the n/N position, never the email or alias
• No concurrent multi-account retry loop or unauthenticated control endpoint was added

Full email display is intentional product behavior and is limited to the loopback dashboard/API plus authenticated device transport. OpenAI access/refresh tokens, API keys, cookies, passwords, and auth-file contents are explicitly excluded from normalized and device payloads.