fix(config): lazy-evaluate paths, fix TOCTOU, segment-boundary cloud detection

- Convert 4 module-level constants to lazy-evaluated functions to avoid
  import-time caching: openrouter-catalog, aggregator, disk-cache, auth-middleware
- Fix symlink-checks.ts to use ccsDir parameter instead of homedir/.ccs,
  remove unused homedir parameter from checkSettingsSymlinks()
- Replace TOCTOU existsSync+statSync with single statSync in try/catch
  for --config-dir validation in ccs.ts
- Switch detectCloudSyncPath from substring to path-segment-boundary matching
  to prevent false positives (e.g., megauser != MEGA, Dropbox-api != Dropbox)
- Add test for false-positive protection

src/utils/config-manager.ts

@@ -73,10 +73,11 @@ const CLOUD_SYNC_PATTERNS = [
  */
 export function detectCloudSyncPath(dir: string): string | null {
   const normalized = dir.replace(/\\/g, '/').toLowerCase();
+  const segments = normalized.split('/');
   for (const pattern of CLOUD_SYNC_PATTERNS) {
-    if (normalized.includes(pattern.toLowerCase())) {
-      return pattern; // Return original casing for display
-    }
+    const patternLower = pattern.toLowerCase();
+    // Exact path segment match to avoid false positives (e.g., "megauser" != "MEGA")
+    if (segments.some((s) => s === patternLower)) return pattern;
   }
   return null;
 }