fix(auth): close the account pre-emption + wrong-account link holes (E1 S5, SEC-10/11)

SEC-10 (account pre-emption / "pre-hijack"): a password set on an account whose
email was never verified is untrusted — whoever registered the address (to
pre-empt the real owner) could have chosen it. Both the Google-adoption callback
and admin activation (_activate_user_by_email) now drop that pre-set password and
bump the session epoch when the account isn't email_verified, so a later Google
login / admin approval can't hand the pre-set password a working login. No-op for
a verified account (the legit no-SMTP flow). +2 tests.

SEC-11 (link/upgrade bound to the session default): the OAuth link/upgrade GETs
resolved to the session DEFAULT account, so a tab acting as a secondary account
would link Google / the YouTube grant to the wrong account. The frontend now
threads the active account through the navigation URL (withActiveAccount ->
?account=<active>), and _complete_link accepts any wallet account, not only the
default, so the identity lands on the account that started the flow.

frontend/src/lib/onboarding.ts

@@ -12,6 +12,7 @@
 //                                       suppresses the auto-popup on future logins (they
 //                                       can still reopen it from Settings → Account).
 
+import { withActiveAccount } from "./activeAccount";
 import { getAccountRaw, LS, setAccountRaw } from "./storage";
 
 const ONBOARD_ACTIVE = "siftlode.onboarding.active"; // sessionStorage (not in LS, which is localStorage)
@@ -36,7 +37,7 @@ export function shouldAutoOpenOnboarding(me: {
 /** Mark a grant as in progress, then send the user to Google's consent screen. */
 export function beginGrant(access: "read" | "write"): void {
   sessionStorage.setItem(ONBOARD_ACTIVE, "1");
-  window.location.href = `/auth/upgrade?access=${access}`;
+  window.location.href = withActiveAccount(`/auth/upgrade?access=${access}`);
 }
 
 /** Leave the wizard. `dismiss` suppresses the future auto-popup (used when read is skipped). */