fix(cliproxy): use sibling auth-paused/ dir to prevent token refresh loops

CLIProxyAPI's watcher uses filepath.Walk() which recursively scans
all subdirectories of auth/. Moving paused tokens to auth/paused/
subdirectory didn't hide them from CLIProxyAPI, causing token refresh
loops where paused tokens were immediately recreated.

Solution: Use auth-paused/ as a sibling directory instead of auth/paused/
subdirectory. This places paused tokens completely outside CLIProxyAPI's
scan path, preventing token discovery and refresh.

Path change:
- Before: ~/.ccs/cliproxy/auth/paused/
- After:  ~/.ccs/cliproxy/auth-paused/

src/cliproxy/account-manager.ts

@@ -6,6 +6,7 @@
  *
  * Account storage: ~/.ccs/cliproxy/accounts.json
  * Token storage: ~/.ccs/cliproxy/auth/ (flat structure, CLIProxyAPI discovers by type field)
+ * Paused tokens: ~/.ccs/cliproxy/auth-paused/ (sibling dir, outside CLIProxyAPI scan path)
  */
 
 import * as fs from 'fs';
@@ -138,9 +139,14 @@ export function getAccountsRegistryPath(): string {
 /**
  * Get path to paused tokens directory
  * Paused tokens are moved here so CLIProxyAPI won't discover them
+ *
+ * Uses sibling directory (auth-paused/) instead of subdirectory (auth/paused/)
+ * because CLIProxyAPI's watcher uses filepath.Walk() which recursively scans
+ * all subdirectories of auth/. A sibling directory is completely outside
+ * CLIProxyAPI's scan path, preventing token refresh loops.
  */
 export function getPausedDir(): string {
-  return path.join(getAuthDir(), 'paused');
+  return path.join(getCliproxyDir(), 'auth-paused');
 }
 
 /**