fix(proxy): correct account failover so a healthy account is always used

[locchh]

Account selection was blind to several "this account can't serve right now" signals, so the session strategy would stick to an unusable account instead of failing over to a healthy one. The symptom looked model-specific (e.g. "Sonnet works but Opus doesn't") but was purely a timing artifact of which account was unavailable at the moment.

Fixes:

• Overage-aware rate limiting: when Anthropic returns anthropic-ratelimit-unified-overage-status: allowed, the account is still serving requests past its primary limit. Previously ccflare benched it until the multi-hour primary reset, discarding a working account. Now it applies a short cooldown instead of a multi-hour lock.

• Failover skips token-refresh-backed-off accounts: refresh failures were tracked only in an in-memory map the load balancer could not see, so an account with a dead/failing token kept being selected. Extracted the registry into refresh-backoff.ts and made SessionStrategy treat a backed-off account as unusable. Self-healing: the account returns once the backoff clears.

• Rate limit without a reset time still marks the account: a quota hit whose response carried no parseable reset time was logged but never marked, so selection kept choosing it. Now applies a default cooldown.

All three are self-healing; no account is permanently disabled.

Verified live: with a dead-token account and a healthy account, requests fail over to the healthy account and both Sonnet and Opus return 200.