feat(cc-config): switch between Claude Code accounts, keeping the workspace

Adds a "Switch profile" button left of Backups on /settings?tool=claude-code.
A *profile* is one Anthropic account - one quota - saved under a name, so the
local `claude` CLI can be pointed at a different account without disturbing
anything else.

A switch swaps exactly two identity artifacts and nothing more: `claudeAiOauth`
inside `<CLAUDE_HOME>/.credentials.json`, and `oauthAccount` + `userID` inside
the `.claude.json` config file(s). Those files are key-merged in place, and only
where they already exist, so `projects`/`numStartups`/everything else survives.
Skills, subagents, commands, memory, plugins, marketplaces, MCP servers and
settings are never read or written here - that is what makes a switch keep the
whole workspace and change only the account. `mcpOAuth` stays put too: those are
the machine's MCP server tokens, not account identity.

Profiles are one JSON file each under `<CLAUDE_HOME>/agenthub-profiles/` (dir
0700, files 0600, atomic temp+rename) and hold live OAuth tokens, so no route
ever returns token material - `GET /profiles` answers identity metadata only.

The dashboard cannot log an account in; only `claude auth login` mints tokens.
Adding a profile is therefore always "log in from a terminal, then snapshot what
the CLI wrote". `activateProfile` re-snapshots the outgoing account first so
tokens Claude Code refreshed since its last save are not lost, and refuses
(`EUNSAVED`) to switch away from an account that was never saved - that would
discard the only copy of its credentials. A switch applies to new sessions only,
since a running session rewrites the config on exit.

Routes: GET/POST/DELETE /api/cc-config/profiles, POST /profiles/activate.

Verified: server 1420/1420 (14 new, incl. token-free responses and 0600/0700
permissions), client 459/459.

server/routes/cc-config.js

@@ -14,6 +14,10 @@
  * Every file write is preceded by a timestamped backup. MCP server config
  * stays read-only — it is written concurrently by the running CLI.
  *
+ * Also hosts the auth-profile routes (`/profiles*`) that swap which Anthropic
+ * account the local CLI runs as; those carry identity metadata only, never
+ * token material.
+ *
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
@@ -21,6 +25,7 @@ const { Router } = require("express");
 const cc = require("../lib/cc-discovery");
 const ccMutate = require("../lib/cc-mutate");
 const ccCli = require("../lib/cc-plugin-cli");
+const ccProfiles = require("../lib/cc-profiles");
 const { broadcast } = require("../websocket");
 
 const router = Router();
@@ -332,6 +337,66 @@ router.patch("/settings", (req, res) => {
   }
 });
 
+// ── Auth profiles ──────────────────────────────────────────────────────
+//
+// Switch which Anthropic account (= which quota) the local `claude` CLI runs
+// as, keeping every other config surface in place. Responses carry identity
+// metadata only — never token material. See cc-profiles.js.
+
+const PROFILE_ERR_TO_STATUS = {
+  EBADNAME: 400,
+  EBADREQ: 400,
+  ENOTFOUND: 404,
+  EBADJSON: 409,
+  EACTIVE: 409,
+  EUNSAVED: 409,
+  ENOAUTH: 409,
+};
+
+function profileError(res, e) {
+  const status = PROFILE_ERR_TO_STATUS[e.code] || 500;
+  return res.status(status).json({ error: { code: e.code || "EINTERNAL", message: e.message } });
+}
+
+router.get("/profiles", (_req, res) => {
+  try {
+    res.json(ccProfiles.listProfiles());
+  } catch (e) {
+    return profileError(res, e);
+  }
+});
+
+router.post("/profiles", (req, res) => {
+  try {
+    const result = ccProfiles.saveProfile((req.body || {}).name);
+    emitChanged({ action: "save", type: "profile", name: result.name, project: null });
+    res.json(result);
+  } catch (e) {
+    return profileError(res, e);
+  }
+});
+
+router.post("/profiles/activate", (req, res) => {
+  try {
+    const result = ccProfiles.activateProfile((req.body || {}).name);
+    emitChanged({ action: "activate", type: "profile", name: result.name, project: null });
+    res.json(result);
+  } catch (e) {
+    return profileError(res, e);
+  }
+});
+
+// Identifier travels in the body, not the URL — same reason as DELETE /file.
+router.delete("/profiles", (req, res) => {
+  try {
+    const result = ccProfiles.deleteProfile((req.body || {}).name);
+    emitChanged({ action: "delete", type: "profile", name: result.name, project: null });
+    res.json(result);
+  } catch (e) {
+    return profileError(res, e);
+  }
+});
+
 router.get("/backups", (req, res) => {
   const scope =
     req.query.scope === "user" || req.query.scope === "project" ? req.query.scope : undefined;