fix(frontend): a page opened at a //path boots, and the account-switch copy reads right in Hungarian

Every address-bar writer glued `pathname + query`, so a path of `//evil.com/x` named another host:
history refused it (SecurityError) and the first nav mirror threw the app into its crash screen. One
builder, `hrefHere`, now makes the address from the URL itself and stays on this origin.

frontend/src/lib/entryUrl.ts

@@ -15,6 +15,7 @@
 // with nothing personal in them (login, deleted, account) ride the query string.
 
 import type { NotifLevel } from "./notifications";
+import { hrefHere } from "./urlState";
 
 export const entrySearch = new URLSearchParams(window.location.search);
 export const entryHash = new URLSearchParams(window.location.hash.replace(/^#/, ""));
@@ -37,7 +38,7 @@ export function accountChangedUrl(): string {
   const params = new URLSearchParams(window.location.search);
   const [key, value] = ACCOUNT_CHANGED_FLAG.split("=") as [string, string];
   params.set(key, value);
-  return `${window.location.pathname}?${params.toString()}${window.location.hash}`;
+  return hrefHere(params);
 }
 
 /** Reload a tab whose session the server refused (a 401). Showing another account than the one
@@ -76,12 +77,11 @@ export function clearEntryUrl(): void {
   const keep = hash.has("reset") ? window.location.hash : "";
   if (!dropped.length && !window.location.hash) return;
   if (!dropped.length && keep) return;
-  const qs = params.toString();
   window.history.replaceState(
     // Preserved, not nulled: it carries scroll restoration and the channel entry.
     window.history.state,
     "",
-    `${window.location.pathname}${qs ? `?${qs}` : ""}${keep}`,
+    hrefHere(params, keep),
   );
 }