Confirm account linking

Exchanges the short-lived link_confirm_token (handed to the partner app by the link callback redirect) for an actual Account row attached to the current user's principal. The server matches the bearer's principalId AND appId to the token's values before writing — this is the final ownership check. A collision with an existing Account attached to a different Principal returns HTTP 409; the 200 success shape only covers linked and already_linked_same.