fix(account): the AWS role_arn host-identity check leaks the platform account id and has gaps #531

Summary

The AWS role_arn host-identity check added in #494 leaks the platform's AWS account id to tenant-scoped users and has several gaps.

Location (origin/main 496d9d7)

• internal/credentials/host_identity.go:29,35 VerifyHostAccount puts the raw STS error and the host account id into the ErrNotHostAccount text. internal/purchase/execution.go:251 writes err.Error() into acctExec.Error, a purchase-execution row visible to users scoped to the tenant account. This discloses the platform account id across tenants.
• The STS GetCallerIdentity call (host_identity.go:27) has no timeout of its own. Suggest 5s inside VerifyHostAccount.
• The AmbientSTS wiring at internal/server/app.go:848 has no test; removing it passes all server tests.
• The account test endpoint (internal/api/handler_accounts.go:748) still returns OK "ambient credentials (CUDly host account)" for a non-host account.
• validateAWSAuthMode on account create/update is unchanged, so a bad role_arn config is rejected only at collection or purchase time.

Context

Follow-up to #494. Related: #402 (closed).

Acceptance

Tenant-visible errors omit the host account id, STS has a bounded timeout, the app.go wiring has a test, and the account test endpoint and create/update validation reject a non-host account with an empty role ARN.