feat(account): scaffold configurable backend login panel

[appergb]

Summary

Account scaffold (HANDOFF §3.8). OpenTake ships no official backend; this PR adds a Settings → Account pane that lets a user point the app at a self-hosted backend, verify a token against it, and store that token in the OS keychain. Nothing here gates local editing — the disclaimer is shown prominently and every editing / export / Agent feature works unchanged when signed out.

Changes

Backend (Rust)

• src-tauri/src/account.rs (new) — 5 #[tauri::command]s:
  • account_set_backend_url / account_get_backend_url — persist/clear the backend URL in the keychain (service=opentake-account, account=backend-url). Local only, no network.
  • account_login — POST {backend}/api/auth/verify with Authorization: Bearer, 10s timeout, stores the token in the keychain on success, status → Online.
  • account_logout — clears the token, status → Offline.
  • account_get_status — live AccountStatus (offline/connecting/online/error).
• AccountInfo { userId, email?, plan? } and AccountStatus are #[serde(tag="type", rename_all="camelCase")] — multi-word fields are camelCase on the wire (the repo's docs: CapCut 差距分析 + 进阶能力与 Web 动效插件设计 #1 IPC bug class).
• Honest error: when no backend URL is set, login rejects with "No backend configured. OpenTake has no official backend; set a custom backend URL in Settings." verbatim.
• src-tauri/src/lib.rs — mod account, app.manage(AccountState::default()), 5 commands in generate_handler!.
• src-tauri/Cargo.toml — reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] } (matches opentake-gen; no system OpenSSL).

Frontend (React/TS)

• web/src/lib/types.ts — AccountInfo, AccountStatus (discriminated union by type).
• web/src/lib/api.ts — 5 IPC wrappers, all degrade gracefully outside Tauri.
• web/src/components/settings/AccountPane.tsx (new) — backend URL input + save/clear, token input + login, status badge, logout button, prominent disclaimer. Style mirrors the other panes.
• web/src/components/settings/SettingsView.tsx — "Account" pane in the sidebar (User icon), between AI and About.
• web/src/i18n/dict.ts — account.* keys in both zh-CN and en, including the "no official backend" disclaimer.

Invariants (verified)

• Does not block local features — account state is informational; no editing/export/Agent code path reads it.
• Token in keychain, no plaintext — backend URL + token stored via KeyringStore under a dedicated opentake-account service; plaintext never crosses to JS memory or localStorage.
• Backend URL configurable, never hardcoded — no URL is baked in.
• Honest "no official backend" disclaimer — surfaced in the UI banner and the login error string verbatim.

Verification (all green)

cargo fmt --all                                            OK
cargo clippy --workspace --all-targets -- -D warnings      OK
cargo clippy -p opentake-tauri --no-default-features --all-targets -- -D warnings  OK
cargo test --workspace                                     OK  (account: 9 new unit tests)
pnpm -C web build                                          OK
pnpm -C web test                                           OK  (437 tests)

Closes #HANDOFF-3.8.