fix: register eligible legacy continuity routes

[Pigbibi]

Summary

• retain the bounded legacy-continuity policy in the private console profile cache
• let authenticated deployment reconciliation register a previously unknown legacy route only when the profile/platform policy, audited baseline, and preservation-only inputs all match
• preserve plugin, option-overlay, and cash-only settings during account sync

Safety

• this does not create a new live permission, change a runtime target, deploy a service, or submit an order
• candidate strategies remain blocked by their normal P0-P6 gate
• legacy registration is limited to private Worker KV and audit logged

Validation

• rtk test node --experimental-default-type=module tests/strategy_switch_worker_validation.mjs
• node --check --input-type=module < web/strategy-switch-console/worker.js
• git diff --check
• actionlint is covered by remote CI (not installed on the VPS)