V290 - Account character source guard (V289 base)

FIX: Before V290, anything newly appearing in characters/ while a player
was logged in could be mistaken for the player's own BG2 Export and moved into
characters/<accountname>. That could pull old cached/root files into Drakhysys.

V290 adds an authorization step on the native Export DONE actions, both the
Character Record and character-creation screens. BG2's native Import/Export
panels are preserved. The router only finalizes a new flat-root .CHR/.BIO when
its filename was explicitly confirmed by that logged-in player's Export and the
file is recent. Unknown root files do not move into any account folder. The
router may remove unassigned root .CHR/.BIO files after they are no longer open;
this never recursively deletes anything from account folders.

Existing account folders and all files inside them are left unchanged.
If unwanted old character files already reached characters/Drakhysys, inspect
them manually or run AUDIT_ACCOUNT_CHARACTER_FOLDERS.bat (read-only). Do not
blindly delete the nested files: filenames alone cannot prove ownership.

INSTALL:
1) Close BG2, InfinityLoader, and all other instances of the game.
2) Extract the full V290 archive into the editor/creator directory.
3) Run SETUP_IN_GAME_ACCOUNTS.bat and choose the BG2 game install and BG2
   Documents profile directory containing Baldur.lua.
4) Restart BG2 and test (a) Import Character File, (b) a new native Export,
   and (c) that unassigned root files never appear inside an account folder.

No automatic account character backups. Previous per-account settings backups
remain supported. No migration, deletion or relocation of account-owned files.
The patched Lua must be loaded at game launch; restart after installation.
Live BG2/Windows testing is necessary. The Python regression tests are not
proof that the UI sends the numeric authorization fields on this BG2 build.
