fix(account): show approved scoped custody without false setup guidance

Bind account command text and modal status to the same vault-served main projection used for the account row. Update enrollment-reset usage to describe its explicit-only clear. Exercise both host command paths with a real plugin hook and owner-only approved token fixture; removing the modal argument or command projection reproduces the incorrect inactive/setup status.