feat(api): 账号环境指纹更新端点——PUT /creator/accounts/:id/fingerprint 单独保存并按需重启

- Store.UpdateAccountFingerprint：更新账号绑定环境指纹，seed 保持账号派生值，携带代理直接拒绝（门禁对齐 CreateBoundEnv）
- 运行中的环境先停后启以应用新指纹，未运行仅落库下次启动生效；账号资源锁防并发冲突
- accountEnvironmentView 内联 fingerprint 回显，编辑页预填数据源
- 覆盖：store 层 seed 保留/校验拒绝/JSON 往返、路由畸形入参、PG 端到端（保存/回显/持久化/400/404）

internal/controlplane/api/hub_test.go

@@ -350,6 +350,22 @@ func (s *memoryStore) GetEnvironmentContextForAccount(ctx context.Context, accou
 	s.mu.Unlock()
 	return hub.EnvironmentContext{}, hub.ErrNotFound
 }
+func (s *memoryStore) UpdateAccountFingerprint(_ context.Context, accountID string, fingerprint hub.Fingerprint) (hub.EnvironmentContext, error) {
+	if fingerprint.ProxyServer != "" || fingerprint.Validate() != nil {
+		return hub.EnvironmentContext{}, hub.ErrInvalid
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	for alias, bound := range s.bindings {
+		if bound.AccountID == accountID {
+			fingerprint.Seed = bound.Fingerprint.Seed
+			bound.Fingerprint = fingerprint
+			s.bindings[alias] = bound
+			return bound, nil
+		}
+	}
+	return hub.EnvironmentContext{}, hub.ErrNotFound
+}
 func (s *memoryStore) ValidateEnvironmentRebind(_ context.Context, alias, exitID string, expectedBindingVersion int64) error {
 	s.mu.Lock()
 	defer s.mu.Unlock()