feat: support per-account External IDs

[captainpacket]

Summary

• add scoped External ID set/clear for one or more AWS accounts
• add strict CSV imports for different per-account values and explicit clear actions
• preserve mixed External IDs across NQE, webhook, and manifest syncs
• fail closed when mixed-ID setups add accounts without explicit assignments
• update operator docs, flowcharts, and release notes

Validation

• make ci
• 101 unit tests
• race detector
• govulncheck: no called vulnerabilities
• CLI help verified for external-id and preflight

Release

Intended for v2.3.0 after merge.