fix: skip disabled accounts in proactive token refresh

Closes #337

Disabled accounts were still receiving proactive token refresh because
getAccountsNeedingRefresh() used getAccounts() without filtering by
enabled status.

Added check for account.enabled === false to skip disabled accounts
in the refresh queue, matching the pattern used elsewhere in the codebase.

Also added comprehensive test coverage for the refresh queue's account
filtering logic.