fix: don't clobber or leak a sibling account's session/usage data

[achappell]

Summary

Split out of #250 per review feedback — this is a standalone correctness fix, independent of the OpenCode quota display work.

Found while adding a second OpenCode account (work + personal, different browsers) on the same machine — two independent instances of the same bug class showed up:

• opencode/perplexity session clobbering: Fetch() refreshed the stored browser session from the live browser cookie on every poll (shared.LoadOrRefreshBrowserSession). With two accounts sharing the same fixed cookie domain but different source browsers, whichever account polled last would silently overwrite the other's stored session. Both providers now read the stored session directly from credentials.json (config.LoadSession) instead of refreshing it.
• telemetry provider-scope leak: the provider-scope fallback in applyCanonicalUsageViewWithDB kicked in whenever an account had no account-scoped telemetry, without checking whether the account was the only one mapped to that provider. Two sibling accounts sharing a provider ID (e.g. two opencode accounts) meant one account's local usage/message/token data could leak onto the other. The fallback is now gated on the source-provider set mapping to exactly one account.

Testing

• go build ./..., gofmt -l, go vet all clean on the touched packages.
• go test ./internal/providers/opencode/... ./internal/providers/perplexity/... ./internal/telemetry/... — all green.
• New regression test: TestApplyCanonicalUsageView_DoesNotLeakProviderScopeAcrossSiblingAccounts.
• Existing TestFetch_ConsoleEnrichmentAutoDiscoversWorkspaceID updated to stub the seam that's actually on the call path now (loadStoredSession instead of the now-unused loadBrowserSession).