fix: replace hardcoded provider validation arrays with CLIPROXY_PROFILES import

Closes #382

Replace duplicate hardcoded provider validation arrays across three route files
with a single import from CLIPROXY_PROFILES constant. This DRY fix eliminates
code duplication and ensures provider validation is consistent across all routes.

Files updated:
- account-routes.ts
- cliproxy-auth-routes.ts
- cliproxy-stats-routes.ts

Reduces code by 21 lines while improving maintainability.

src/web-server/routes/account-routes.ts

@@ -17,20 +17,13 @@ import {
   soloAccount,
 } from '../../cliproxy/account-manager';
 import type { CLIProxyProvider } from '../../cliproxy/types';
+import { CLIPROXY_PROFILES } from '../../auth/profile-detector';
 
 const router = Router();
 const registry = new ProfileRegistry();
 
-/** Valid CLIProxy providers */
-const VALID_PROVIDERS: CLIProxyProvider[] = [
-  'gemini',
-  'codex',
-  'agy',
-  'qwen',
-  'iflow',
-  'kiro',
-  'ghcp',
-];
+/** Valid CLIProxy providers - derived from canonical CLIPROXY_PROFILES */
+const VALID_PROVIDERS: CLIProxyProvider[] = [...CLIPROXY_PROFILES];
 
 /** Check if provider is valid */
 function isValidProvider(provider: string): provider is CLIProxyProvider {

src/web-server/routes/cliproxy-auth-routes.ts

@@ -35,19 +35,12 @@ import { loadOrCreateUnifiedConfig } from '../../config/unified-config-loader';
 import { tryKiroImport } from '../../cliproxy/auth/kiro-import';
 import { getProviderTokenDir } from '../../cliproxy/auth/token-manager';
 import type { CLIProxyProvider } from '../../cliproxy/types';
+import { CLIPROXY_PROFILES } from '../../auth/profile-detector';
 
 const router = Router();
 
-// Valid providers list
-const validProviders: CLIProxyProvider[] = [
-  'gemini',
-  'codex',
-  'agy',
-  'qwen',
-  'iflow',
-  'kiro',
-  'ghcp',
-];
+// Valid providers list - derived from canonical CLIPROXY_PROFILES
+const validProviders: CLIProxyProvider[] = [...CLIPROXY_PROFILES];
 
 /**
  * GET /api/cliproxy/auth - Get auth status for built-in CLIProxy profiles

src/web-server/routes/cliproxy-stats-routes.ts

@@ -14,6 +14,7 @@ import {
 } from '../../cliproxy/stats-fetcher';
 import { fetchAccountQuota } from '../../cliproxy/quota-fetcher';
 import type { CLIProxyProvider } from '../../cliproxy/types';
+import { CLIPROXY_PROFILES } from '../../auth/profile-detector';
 import {
   getCliproxyWritablePath,
   getCliproxyConfigPath,
@@ -517,16 +518,8 @@ router.put('/models/:provider', async (req: Request, res: Response): Promise<voi
 router.get('/quota/:provider/:accountId', async (req: Request, res: Response): Promise<void> => {
   const { provider, accountId } = req.params;
 
-  // Validate provider
-  const validProviders: CLIProxyProvider[] = [
-    'agy',
-    'gemini',
-    'codex',
-    'qwen',
-    'iflow',
-    'kiro',
-    'ghcp',
-  ];
+  // Validate provider - use canonical CLIPROXY_PROFILES
+  const validProviders: CLIProxyProvider[] = [...CLIPROXY_PROFILES];
   if (!validProviders.includes(provider as CLIProxyProvider)) {
     res.status(400).json({
       error: 'Invalid provider',