fix: review round 4 — an account switch unloads as the old account, a share link's lockout costs five networks

Deep-review round 4, targeted at round 3's changes (f569b19c..e7f38396).

Accounts
- Switching, adding or signing out an account moved the tab's pin before
  the page unloaded, so the players' resume beacons fired on the way out
  under the NEW account: one account's playback position saved into the
  other. The pin is now handed to the next page (pinOnNextPage) and taken
  over at import; clearActiveAccount is gone.
- Switching to a suspended account was refused but left it in the
  switcher, refused on every click; a deactivated one was not refused at
  all, and made the default it signed every account in the browser out on
  the next request. Every account _session_user would refuse — gone,
  deactivated, suspended, revoked — is refused and dropped from the list.

Share page (/watch)
- An IPv6 client is limited by its /64 (client_ip becomes client_key, for
  every limiter): keyed on the full address, one subscriber could rotate
  through endless identities. The comments now state what the per-link
  ceiling costs: guessing from five networks can keep a link shut for its
  window, and guesses already running when it fills are still checked.
- The link is looked up before the limiter records the attempt, so made-up
  tokens no longer grow it by an entry each.

Forms
- Failing the same way twice is announced again: the sign-in, passphrase
  and setup errors are keyed on the attempt (a clear and a set in one
  handler left the alert node untouched).
- The install wizard's own validation showed the generic error — it threw
  plain objects its catch did not read. It sets the step's message.

Tests: a re-pin leaving the previous account's notices behind; the pin
hand-over; switching to an ended account; the /64 viewer; made-up tokens;
the repeated alerts. Each mutation-checked RED for its own reason.

backend/app/routes/auth.py

@@ -39,7 +39,7 @@ from app.auth import (
 from app.config import settings
 from app.db import SessionLocal, get_db
 from app.models import AuthToken, DemoWhitelist, Invite, OAuthToken, User
-from app.ratelimit import RateLimiter, client_ip
+from app.ratelimit import RateLimiter, client_key
 from app.security import encrypt, hash_password, hash_token, verify_password
 from app.utils import canonical_email, valid_email
 
@@ -642,7 +642,7 @@ async def request_access(
     email = (body.email or "").strip().lower()
     if not valid_email(email):
         raise HTTPException(status_code=400, detail="Enter a valid email address.")
-    if not _request_access_limiter.allow(client_ip(request)):
+    if not _request_access_limiter.allow(client_key(request)):
         return {"status": "pending"}
     if is_allowed(db, email):
         return {"status": "pending"}  # already allowed — don't reveal it
@@ -659,7 +659,7 @@ def demo_login(body: EmailIn, request: Request, db: Session = Depends(get_db)) -
     so there is no visible 'demo login' button. Rate-limited per IP; when blocked it answers
     exactly like a non-match (authenticated=false) so the field can't be hammered as an
     enumeration oracle. On a match it sets the session and the client reloads into the app."""
-    if not _demo_limiter.allow(client_ip(request)):
+    if not _demo_limiter.allow(client_key(request)):
         return {"authenticated": False}
     email = (body.email or "").strip().lower()
     if valid_email(email) and is_demo_allowed(db, email):
@@ -805,7 +805,7 @@ def register(
         )
     if not sysconfig.get_bool(db, "allow_registration"):
         raise HTTPException(status_code=403, detail="Registration is currently closed.")
-    if not _register_limiter.allow(client_ip(request)):
+    if not _register_limiter.allow(client_key(request)):
         return {"status": "ok"}  # silently throttle; uniform response
 
     # Do the existence check + account creation OFF the response path (a background task with its own
@@ -973,7 +973,7 @@ def verify_email_resend(
     and re-registering an already-registered email is a silent no-op, so a user who lost the first
     mail had no way back. Uniform response + timing regardless of whether the email has a pending
     account (the lookup runs off the response path), so it can't probe for registered emails."""
-    if not _verify_resend_limiter.allow(client_ip(request)):
+    if not _verify_resend_limiter.allow(client_key(request)):
         return {"status": "ok"}  # silently throttle; uniform response
     email = (body.email or "").strip().lower()
     if valid_email(email):
@@ -1032,7 +1032,7 @@ def password_login(
     """Email+password sign-in. Wrong email/password give a single uniform 401 (no enumeration).
     Once the password is proven correct, the owner gets a specific reason if their account is
     still pending or suspended — that's not an enumeration leak (they already hold the password)."""
-    if not _login_limiter.allow(client_ip(request)):
+    if not _login_limiter.allow(client_key(request)):
         raise _login_refused(429, "rate_limited")
     email = (body.email or "").strip().lower()
     password = body.password or ""
@@ -1063,7 +1063,7 @@ def password_reset_request(
 ) -> dict:
     """Request a password-reset link. Uniform response + timing regardless of whether the email has a
     password account (the lookup runs off the response path), so it can't probe for registered emails."""
-    if not _reset_limiter.allow(client_ip(request)):
+    if not _reset_limiter.allow(client_key(request)):
         return {"status": "ok"}
     email = (body.email or "").strip().lower()
     # Do the account lookup + token issue + email OFF the response path (a background task with its
@@ -1112,7 +1112,7 @@ def password_reset_check(body: TokenIn, request: Request, db: Session = Depends(
     told `true`, never `false`: this check may only ever save a user a wasted form, so when it cannot
     answer it must degrade to the old behaviour instead of declaring a live link dead.
     """
-    if not _reset_check_limiter.allow(client_ip(request)):
+    if not _reset_check_limiter.allow(client_key(request)):
         return {"ok": True}
     return {"ok": any(_peek_token(db, body.token, k) is not None for k in _PASSWORD_TOKEN_KINDS)}