Return the paper accounts owned by the currently-authenticated user.

Auth: the shared resolver — session cookie wins, else the X-Vega-Key header user, else a Build-10 account key pair resolved to the desk owner (require_user_or_session, the SAME dependency B12-T1 wired onto the coder deploy/backtest/strategy routes). This lets a key-holding coder LIST their own desks (browser + SDK/CLI both work) — without it a valid X-Vega-Key got 401 here and the coder flow could never discover a desk id to deploy onto. Owner-scoped exactly as before: db.list_user_accounts filters on the resolved uid, so a different principal only ever sees their OWN desks — never anyone else's. Suspension still fails closed (a suspended session/key 403s inside the resolver, never reaching here).