feat: add provider enablement controls

[rexdotsh]

Summary

• add an enabled flag to provider accounts and a provider-wide admin toggle API
• exclude disabled providers from model discovery and both primary and account-scoped proxy routing
• preserve disabled state for newly connected accounts until the provider is re-enabled
• keep disabled accounts available for admin editing, refresh, primary selection, and deletion

API

• GET /admin/accounts now includes providers and per-account enabled
• GET /admin/accounts/providers returns provider statuses
• PATCH /admin/accounts/providers/:provider accepts { "enabled": boolean }

Database

• generated migration 0010_lumpy_sentinels.sql; migration has not been applied

Verification

• bun test (85 pass)
• bun typecheck
• bun lint
• git diff --check

Notes

• temporary proxy debug logging used during diagnosis is not included in this PR