fix: address multi-agent review (ACP, security, API parity)

- ACP: shared notification handler for stream/sync, set_config model, allowlisted env, trackChildProcess, AbortSignal
- Anthropic: ACP streaming path; aligned errors and usage heuristics with chat completions
- SSE: error chunks and [DONE] on ACP/chat stream failures; abort skips pool success/error
- Security: timing-safe API key compare; generic client error text; workspace header under base; reset-hwid SQL validation; token file 0o600
- Docs: README/.env.example gaps; usage token disclaimer; npm audit fix (picomatch)
- Tests: ACP stream + model, account pool stats, workspace allowlist