When objectstore sync is about to download an auth file from R2,
it first queries CLIProxyAPI's local management API for runtime status.
If the auth is already marked invalid (status=error, unavailable,
status_message contains 401/unauthorized/token_invalidated etc),
the file is deleted from R2 instead of downloaded — preventing
invalid auths from being resurrected by sync.
fix: make objectstore sync bidirectional + add mc timeout
- sync() now compares mtime when md5 differs: local newer → upload,
remote newer → download (previously always downloaded)
- local-only files now uploaded to remote instead of deleted
(fixes config changes from management UI not persisting to R2)
- add MC_TIMEOUT=30s to prevent startup hang on R2 unreachable
