[`MetamaskController` A.4] Extract `account-management`

Nobody has claimed this yet.

**Sub-epic:** [#41736 — `MetamaskController` decomposition: `wallet-services` completion](https://github.com/MetaMask/metamask-extension/issues/41736)
**Files:**
- `app/scripts/lib/wallet-services/account-management/index.ts` (new)
- `app/scripts/lib/wallet-services/account-management/account-management.test.ts` (new)
- `app/scripts/metamask-controller.js`

**Size:** L

## Problem

Account management logic lives inline on `MetamaskController`: keyring / account CRUD, `AccountTreeController` wiring, and extension-specific wrappers sit alongside unrelated wallet concerns. This is the second-largest domain cluster on `MetamaskController` after `vault-management`. Extract it into `wallet-services/account-management/` so the responsibility is named and independently testable.

Reconciliation required during extraction: audit every `messenger.call(...)` site against `@metamask/keyring-controller`, `@metamask/accounts-controller`, and `@metamask/account-tree-controller` types. `AccountTreeController` methods that are not yet registered as messenger actions should be injected directly with an explicit upstream-registration TODO.

**Verification sources:** [`app/scripts/controller-init/messengers/`](https://github.com/MetaMask/metamask-extension/tree/main/app/scripts/controller-init/messengers) (keyring + accounts + account-tree messenger files), `@metamask/keyring-controller`, `@metamask/accounts-controller`, `@metamask/account-tree-controller`.

## Solution

1. Create `app/scripts/lib/wallet-services/account-management/` with `index.ts` exporting a structural `AccountManagementMessenger` type and the extracted function bodies.
2. Port the corresponding method bodies from `metamask-controller.js` into the module, performing the per-action audit described above.
3. Export `ACCOUNT_MANAGEMENT_ACTIONS` and `registerActions(messenger)`.
4. Add structural unit tests against a stub messenger.
5. Delete the moved method bodies from `metamask-controller.js`.
6. Update `MetamaskController#getApi()` entries for account management to delegate via messenger.

## Acceptance criteria

- [ ] `app/scripts/lib/wallet-services/account-management/index.ts` exists and owns the extracted logic
- [ ] Every `messenger.call(...)` site matches a real registered action, or is replaced with direct controller injection plus an explicit upstream-registration TODO
- [ ] `AccountTreeController` methods that depend on unregistered class methods are documented with explicit TODOs
- [ ] Full unit-test coverage against structural messenger
- [ ] Moved method bodies are removed from `app/scripts/metamask-controller.js`
- [ ] `getApi()` entries rewritten to call `messenger.call('Module:action', ...)` directly — no forwarding stub remains in `MetamaskController`
- [ ] `yarn test` green, `tsc` green, extension dev build boots

## Dependencies

None.

Start with the account-management methods in app/scripts/metamask-controller.js and the keyring, accounts, and account-tree files under app/scripts/controller-init/messengers/. Compare each messenger.call site with the three controller types before reading the existing controller tests. Done means the new module and structural tests own the logic, getApi() delegates directly, moved methods are removed, and yarn test, tsc, and the extension dev build pass.

Written by the indexing model from the issue text.