AccountScope: let internal-ID callers match groups that store registered accounts' external IDs #1868

Found in the review of #1858 (CodeRabbit thread on the direct RI-exchange list scope).

AccountScope.Allows(id, name) (internal/auth/account_scope.go:190-202) matches a registered account by its internal ID, or by a unique name whose external ID equals the id. A group whose allowed_accounts holds only a registered account's external (provider) ID, kept verbatim by bindGroupAccounts (internal/api/handler_groups.go:167), therefore does not match handlers that pass the internal ID (RI exchange reshape handler_ri_exchange.go:1416, revoke handler_purchases_revoke.go:556, the direct-exchange list and resolve). It fails closed (the row reads as missing), so it is a usability gap, not a leak.

Expected: decide whether groups may store external IDs for registered accounts; if so, make Allows resolve an internal ID through its account's external ID (with the existing guard against an external ID that is also an internal ID), with tests for each handler; if not, reject or normalise external IDs when the group is saved.

Severity: low.