Stricter profileId scoping option for single-key multi-tenant SaaS

For reseller/SaaS setups running many profiles under one API key, profileId on GET /v1/accounts is currently an optional filter — omitting it returns all accounts across the key, and an unknown profileId silently returns an empty list. That makes profile isolation entirely client-enforced.

Requesting an account-level opt-in for a hard server-side boundary, specifically:

1. Make profileId required on GET /v1/accounts — reject the request if missing.

2. Return an error on an unknown/invalid profileId instead of an empty list.

This would give defense-in-depth for anyone building multi-tenant on a single key, rather than relying solely on always-pass-the-right-id + re-filter on our side.