…e tracking (#36)

- Move codex profiles from ~/.onwatch/codex-profiles/ to data directory
  (alongside SQLite DB) so Docker volume mount covers them automatically.
  Auto-migrate existing profiles from the legacy path on startup.
- Add deleted_at column to provider_accounts for soft-delete support.
  CLI delete marks DB immediately; daemon scanner acts as safety net.
- Add external_id column for account-level dedup using Codex account_id
  from JWT/API. Block duplicate profile saves for the same account.
- Deduplicate existing duplicates on startup: active over deleted,
  lower ID wins, all telemetry data merged (never deleted).
- Mark orphaned DB rows (no profile file, no running agent) as deleted
  on startup so they don't appear on dashboard.
- Dashboard hides deleted profiles by default. Settings shows deleted
  profiles with "Deleted" badge, disabled telemetry toggle, and option
  to view historical data.
- Fix XSS: escape profile names in settings innerHTML.
- Add download retry with backoff for self-update binary downloads.

Closes #36