fix: validate account on mapping PUT; gate folders btn during run; prune stale mapping keys; drop dead export

internal/httpapi/accounts.go

@@ -228,11 +228,20 @@ func (s *Server) handleProbeAccountFolders(w http.ResponseWriter, r *http.Reques
 
 // handleSetAccountFolderMapping persists one account's rename map + excluded set.
 func (s *Server) handleSetAccountFolderMapping(w http.ResponseWriter, r *http.Request) {
+	taskID, err := pathID(r, "id")
+	if err != nil {
+		http.Error(w, "bad id", http.StatusBadRequest)
+		return
+	}
 	accID, err := pathID(r, "accountId")
 	if err != nil {
 		http.Error(w, "bad account id", http.StatusBadRequest)
 		return
 	}
+	if _, ok := s.findAccount(r, taskID, accID); !ok {
+		http.Error(w, "account not found", http.StatusNotFound)
+		return
+	}
 	var body struct {
 		Mapping  map[string]string `json:"mapping"`
 		Excluded []string          `json:"excluded"`