ibkr: use IBKR account number as the canonical Account.id

Bug: provider passed the WF UUID as Account.id. ensure_account looks up
existing accounts by (provider, providerAccountId=Account.id), so the
WF-UUID-as-providerAccountId would never match the manually-created
account (which has providerAccountId=U13279690), causing the pipeline
to create a duplicate WF account on every cron run.

Fix: Account.id is now the IBKR account number (U13279690) throughout.
The pipeline's _ensure_accounts() resolves it to the WF UUID via the
canonical (provider, providerAccountId) lookup; activities are remapped
before import. CLI no longer takes the WF UUID — derives it post-import
via a cheap idempotent ensure_account call for the reconciliation step.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

tests/providers/test_ibkr.py

@@ -145,7 +145,6 @@ async def test_ibkr_provider_fetch_returns_mapped_activities(
     provider = IBKRProvider(
         token="t",
         query_id="q",
-        wf_account_id="wf-acct",
         upstream_account_id="U12345678",
     )
     activities = [a async for a in provider.fetch()]
@@ -168,7 +167,6 @@ async def test_ibkr_provider_account_mismatch_raises(
     provider = IBKRProvider(
         token="t",
         query_id="q",
-        wf_account_id="wf-acct",
         upstream_account_id="U99999999",  # WRONG
     )
     with pytest.raises(IBKRAccountMismatchError, match="U12345678"):
@@ -188,7 +186,6 @@ async def test_ibkr_provider_open_positions_after_fetch(
     provider = IBKRProvider(
         token="t",
         query_id="q",
-        wf_account_id="wf-acct",
         upstream_account_id="U12345678",
     )
     # drain the iterator before reading positions