refactor(config): introduce ExternalIDsByProvider map for multi-provider external-ID scoping

[cristim]

Summary

The current PurchaseHistoryFilter.ExternalIDs []string treats all external account numbers (e.g. AWS account IDs, Azure subscription IDs) as a flat list with no provider context. This means a filter for account number 123456789012 could in principle match rows from any provider that happens to share that number, rather than only matching the intended provider's rows.

Proposed change

Replace ExternalIDs []string with ExternalIDsByProvider map[string][]string (provider key -> list of external IDs). The predicate builder would then emit:

(cloud_account_id = ANY($u)
   OR (provider = $p1 AND account_id = ANY($ids_for_p1))
   OR (provider = $p2 AND account_id = ANY($ids_for_p2))
   ...)

This ensures a filter for aws/123456789012 never pulls azure/123456789012 rows.

Scope

• internal/config/types.go: PurchaseHistoryFilter.ExternalIDs -> ExternalIDsByProvider map[string][]string
• internal/config/store_postgres.go: appendAccountPredicate gains provider grouping
• internal/api/analytics_postgres.go: accountFilterClause gains provider grouping (the full version reverted in PR fix(api): filter purchases by account UUID AND external id (closes #701, #498, #866) #956 is the target shape)
• internal/api/scoping.go: resolveAccountFilterIDs / resolveSingleAccountFilterIDs return map[string][]string instead of []string
• internal/api/handler_dashboard.go, handler_history.go, handler_analytics.go: update callers

Notes

• This was partially implemented in the fix/account-filter-id-representation branch but reverted (PR fix(api): filter purchases by account UUID AND external id (closes #701, #498, #866) #956) because it was build-breaking and outside the PR's focused scope. The full sortedProviderKeys + per-provider predicate logic is the intended end state.
• The ExternalIDs []string flat form (landed in PR fix(api): filter purchases by account UUID AND external id (closes #701, #498, #866) #956) is the correct interim shape while this refactor is pending.
• Add a regression test that verifies an aws-scoped filter does not match a row whose provider = 'azure' and account_id happens to be the same string.