fix(frontend): a page opened at a //path boots, and the account-switch copy reads right in Hungarian

Every address-bar writer glued `pathname + query`, so a path of `//evil.com/x` named another host:
history refused it (SecurityError) and the first nav mirror threw the app into its crash screen. One
builder, `hrefHere`, now makes the address from the URL itself and stays on this origin.

frontend/src/lib/accountSwitchNotice.dom.test.ts

@@ -80,11 +80,26 @@ describe("the reload of a tab another account signed in under", () => {
     clearEntryUrl();
     expect(window.location.search).toBe("?page=stats");
   });
+
+  it("stays on this origin when the path starts with //", () => {
+    // Glued as `pathname + query`, a path of `//evil.com/x` names another host: history refuses
+    // it, and the boot that strips the flag threw into the crash screen.
+    const origin = window.location.origin;
+    window.history.replaceState(null, "", `${origin}//evil.com/x?page=stats`);
+    window.history.replaceState(null, "", accountChangedUrl());
+    expect(window.location.origin).toBe(origin);
+    expect(window.location.pathname).toBe("//evil.com/x");
+    clearEntryUrl();
+    expect(window.location.origin).toBe(origin);
+    expect(window.location.pathname).toBe("//evil.com/x");
+    expect(window.location.search).toBe("?page=stats");
+  });
 });
 
 describe("a tab whose session the server refused", () => {
   const stubLocation = () => {
     const loc = {
+      href: "http://h/?page=stats",
       pathname: "/",
       search: "?page=stats",
       hash: "",