feat: Proactive auto-switch before hitting rate limits (opt-in)

When the active account's 5-hour or weekly utilization reaches a
configurable threshold (default 90%), automatically switch to the
saved account with the most quota left - so a running Claude Code
session continues on the next request with a fresh account instead
of stopping at the limit.

- New Services/AutoSwitchEngine.swift: pure, UI-independent decision
  logic. Binding window = max(5h, 7d) utilization; a candidate must
  have a stored backup token, not be flagged expired, and sit at
  least 10% below the threshold (hysteresis, so two accounts
  hovering at the line never ping-pong).
- AppState: evaluateAutoSwitch() runs at the end of every refresh().
  Guardrails: 5-minute cooldown between automatic switches,
  re-entrancy flag (switchTo -> refresh recursion is a no-op),
  same-provider candidates only.
- SettingsView: new 'Auto-switch' section on the General tab -
  enable toggle + threshold slider (50-99%), persisted via
  @AppStorage. Default is OFF: no behavior change unless enabled.

The threshold + hysteresis + cooldown design follows the proven
approach of existing auto-switchers (claude-swap).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>