feat(proxy): propagate account-level proxy across all surfaces

- chatSurface/openAiResponsesSurface: extract channelProxyUrl once and pass to withSiteRecordProxyRequestInit
- geminiSurface: switch from withSiteProxyRequestInit to withSiteRecordProxyRequestInit with channelProxyUrl
- balanceService: pass accountProxyUrl to sub2api token refresh requests
- siteProxy: fix isAccountOverride to only be true when account proxy differs from site proxy
- Accounts.tsx: use parseAccountExtraConfig helper for proxy badge display

src/server/services/balanceService.ts

@@ -201,7 +201,7 @@ async function refreshSub2ApiManagedSession(params: {
       method: 'POST',
       headers,
       body: JSON.stringify({ refresh_token: refreshToken }),
-    }));
+    }, getProxyUrlFromExtraConfig(params.account.extraConfig)));
     payload = await response.json().catch(() => null);
   } catch (err: any) {
     throw new Error(err?.message || 'sub2api token refresh request failed');
@@ -382,23 +382,23 @@ export async function refreshBalance(accountId: number) {
   let activeExtraConfig = account.extraConfig;
   let balanceInfo: BalanceInfo | null = null;
 
+  const accountProxyUrl = getProxyUrlFromExtraConfig(account.extraConfig);
+
   if (isSub2ApiPlatform(site.platform)) {
     const managedAuth = getSub2ApiAuthFromExtraConfig(activeExtraConfig);
     if (managedAuth?.refreshToken && isNearTokenExpiry(managedAuth.tokenExpiresAt)) {
       try {
-        const refreshed = await refreshSub2ApiManagedSession({
+        const refreshed = await withAccountProxyOverride(accountProxyUrl, () => refreshSub2ApiManagedSession({
           account,
           site,
           currentAccessToken: activeAccessToken,
           currentExtraConfig: activeExtraConfig,
-        });
+        }));
         activeAccessToken = refreshed.accessToken;
         activeExtraConfig = refreshed.extraConfig;
       } catch {}
     }
   }
-
-  const accountProxyUrl = getProxyUrlFromExtraConfig(account.extraConfig);
   const readBalance = async (token: string) => withAccountProxyOverride(accountProxyUrl,
     () => adapter.getBalance(site.url, token, platformUserId));
   const handleBalanceError = async (err: any) => {

src/server/services/siteProxy.ts

@@ -470,8 +470,10 @@ export function withSiteRecordProxyRequestInit(
     nextOptions.headers = mergedHeaders;
   }
   const accountNormalized = normalizeSiteProxyUrl(accountProxyUrl);
-  const proxyUrl = accountNormalized || resolveProxyUrlForSite(site);
-  return withExplicitProxyRequestInit(proxyUrl, nextOptions, !!accountNormalized);
+  const siteProxyUrl = resolveProxyUrlForSite(site);
+  const proxyUrl = accountNormalized || siteProxyUrl;
+  const isAccountOverride = !!accountNormalized && accountNormalized !== siteProxyUrl;
+  return withExplicitProxyRequestInit(proxyUrl, nextOptions, isAccountOverride);
 }
 
 export function resolveChannelProxyUrl(