fix: don't fail a switch when `claude auth status` omits the account

`claude auth status` only emits `email`, `orgId`, `orgName` and
`subscriptionType` when `authMethod == "claude.ai"` — that is, when the
stored claude.ai login is the credential source the CLI actually resolves
to. Any higher-precedence source shadows the stored login and the whole
identity block is omitted while `loggedIn` stays `true`:
`ANTHROPIC_AUTH_TOKEN`, `CLAUDE_CODE_OAUTH_TOKEN`, an `apiKeyHelper`, an
OAuth token file, an Anthropic profile in `~/.config/anthropic`, or a
third-party provider (Bedrock/Vertex/…).

Step 4 of `switchAccount` compared that missing field against the target
email, so a perfectly successful swap was reported as

    Switch failed: expected <email> but got unknown.
    Try removing and re-adding the account.

which sent users into a re-authorization loop that can never help,
because nothing is wrong with the credentials (#18).

Verification now distinguishes the two cases:

* `email` present and different → still a real mismatch, unchanged error.
* `email` absent → verify against ground truth CCSwitcher owns instead:
  the live keychain accessToken must equal the target backup's, and the
  `~/.claude.json` identity must be the target email. On match the switch
  succeeds and the user gets a warning naming the shadowing credential
  source; on mismatch it fails as before.

The same absence made `addAccount`, `loginNewAccount` and
`reauthenticateAccount` claim "Not logged in" / "Login did not complete"
while the CLI was in fact authenticated; they now report the shadowing
source and what to unset.

Adds `AuthStatus.reportsClaudeAiIdentity` / `.shadowingAuthMethod`,
documents the CLI contract in ARCHITECTURE.md, and localizes the two new
strings for en/de/fr/ja/zh-Hans.