fix: cap unbounded state growth in maps and sets

Bounds four long-lived in-memory collections so they cannot grow
without limit across long OpenCode sessions:

- fileAccountMap capped at 1000 with FIFO eviction via new
  capFileAccountMap helper in commands/router.ts.
- #statsDeltas on AccountManager capped at 100. When hit, a forced
  saveToDisk flush is scheduled; the existing 1s debounced save keeps
  steady-state size well below the cap.
- debouncedToastTimestamps capped at 50 with FIFO eviction, only
  evicting when inserting a brand-new key so timestamp updates for
  an existing key never collaterally drop another entry.

pendingSlashOAuth already has TTL-based cleanup via
pruneExpiredPendingOAuth in oauth-flow.ts (10 min via
PENDING_OAUTH_TTL_MS), invoked before every .set(); no change needed.

All caps documented with JSDoc explaining bound rationale.