fix: don't block account-scoped refresh on zero-zone accounts

[michielappelman]

Problem

MetricExporter.refreshWithTimeRange and updateZoneContext gate account-scoped refresh on state.zones.length === 0, using it as a proxy for "context not yet initialized."

Magic Transit-only accounts (or any account where the token can't list zones, or the account simply has none) can legitimately have zero zones. For these accounts, this check is permanently true, so isFirstContext never fires and every subsequent alarm hits the "no zone context yet" skip - meaning every account-level query (magic-transit, magic-transit-slo, magic-transit-traffic, magic-firewall-samples, worker-totals, logpush-account, images) silently never runs for that account, even though none of these queries use zone data at all.

Found while debugging why Magic Transit metrics were completely absent (not just wrong) for a zero-zone account - /metrics showed cloudflare_accounts 1 but nothing else, and Worker logs showed "Skipping refresh - no account context yet"/"Skipping refresh - no zone context yet" repeating indefinitely.

Fix

Track "has this exporter ever received a context push" via accountId === "" (the actual uninitialized-state sentinel already used elsewhere in MetricExporterState) instead of zones.length === 0, in both the isFirstContext check in updateZoneContext and the skip-gate in refreshWithTimeRange. This correctly distinguishes "never initialized" from "initialized with zero zones," and has no effect on accounts that do have zones.

Testing

• tsc --noEmit and vitest run (56 existing tests) pass.
• biome check clean.
• Verified live on a deployed Worker against a zero-zone Magic Transit account: before this fix, no account-level metrics ever appeared; after, magic-transit/magic-transit-traffic/magic-firewall-samples all populate correctly on schedule.