fix: reconcile upstream keys on list/generate/import to prevent stale key imports

- Extract reconcile_upstream_keys() to website_sync.py (shared scheduler + on-demand)
- Add reconcile_upstream_keys_full() for on-demand reconciliation at three entry points:
  list_generated_keys, generate_keys_by_groups, import_upstream_keys_as_accounts
- Safe on failure: active_group_ids=None / remote_key_ids=None skip cleanup
- Support custom managed_prefix via _fetch_remote_managed_key_ids() helper
- Exclude orphaned keys from frontend importable list
- Remove hardcoded search='SmartUp' from scheduler path

frontend/src/views/Websites.vue

@@ -592,6 +592,7 @@ function isImportableGeneratedKey(item: GeneratedUpstreamKey) {
   return item.id !== null
     && item.has_key_value
     && item.status !== 'failed'
+    && item.status !== 'orphaned'
     && !(item.imported_website_id === importAccountsForm.value.website_id && item.imported_account_id)
 }