fix(proxy): refresh takeover backup on hot-switch

[unive3sal]

Refresh the restore backup from the selected provider during takeover hot-switches so disabling proxy restores the provider the user chose instead of the one active when takeover began.

Fixes #292

[SaladDay]

@unive3sal Thanks for the fix. The direction makes sense, but I think this still needs one more pass before merge.

The new backup refresh currently uses a two-way merge from the existing restore backup into the selected provider snapshot. That updates keys that exist in the selected provider, but it does not remove provider-owned keys that only existed on the previous provider.

A concrete case:

• provider A restore backup has env.ANTHROPIC_API_KEY = a-key, env.ANTHROPIC_BASE_URL = https://a.example, and env.LOCAL_ONLY = kept
• provider B only has env.ANTHROPIC_API_KEY = b-key
• hot-switch to provider B

After update_live_backup_from_provider, the restore backup becomes:

{
  "env": {
    "ANTHROPIC_API_KEY": "b-key",
    "ANTHROPIC_BASE_URL": "https://a.example",
    "LOCAL_ONLY": "kept"
  }
}

So disabling proxy would restore provider B's key mixed with provider A's base URL. That still leaves part of #292 unfixed.

I think this needs a base-aware merge: base = previous selected provider snapshot, local = existing restore backup, incoming = newly selected provider snapshot. That would preserve local-only fields like LOCAL_ONLY, while removing old provider-owned fields that the new provider no longer has. Codex TOML likely needs the same stale-key consideration too, not only Claude JSON.

Could you add a regression test for this case? The current tests cover overwriting shared keys and preserving local-only keys, but not removing stale provider-owned keys.

[SaladDay]

LGTM, THANKS