fix: guide Pro/Team upgrades and denied Cloud Sync recovery

[Coding-Dev-Tools]

What changed

• Every local dashboard upgrade, trial, and Team Cloud link now includes the selected plan query parameter.
• A full Cloud Sync authorization denial now returns a 401/402/403 response and restores the hosted Pro/Team recovery CTA instead of looking like a zero-item successful sync.

Why

The live account portal uses plan=pro or plan=team to preselect checkout, but the local client previously opened a generic account URL. Separately, an expired, revoked, or no-longer-entitled Cloud Sync session could appear to sync successfully when every workspace was denied.

Impact

Unlicensed local users land on the correct Pro or Team option before account creation and Stripe Checkout. Customers whose hosted entitlement is no longer valid receive a clear reconnect or upgrade path.

Validation

• 5 Playwright commercial/accessibility tests passed on an isolated dashboard server.
• Focused Python dashboard, licensing, Cloud Sync, and Cloud feature tests passed with one expected skip.
• ruff check .
• git diff --check

[Coding-Dev-Tools]

Superseded by #69. The replacement includes the complete local v1.0.1 candidate, resolves this branch’s dashboard conflict, correctly distinguishes partial zero-export success from total authorization denial, preserves recovery after Settings reload, and adds the full release-hardening fixes and validation evidence. All checks on #69 are green.