fix: review round 4 — an account switch unloads as the old account, a share link's lockout costs five networks

Deep-review round 4, targeted at round 3's changes (f569b19c..e7f38396).

Accounts
- Switching, adding or signing out an account moved the tab's pin before
  the page unloaded, so the players' resume beacons fired on the way out
  under the NEW account: one account's playback position saved into the
  other. The pin is now handed to the next page (pinOnNextPage) and taken
  over at import; clearActiveAccount is gone.
- Switching to a suspended account was refused but left it in the
  switcher, refused on every click; a deactivated one was not refused at
  all, and made the default it signed every account in the browser out on
  the next request. Every account _session_user would refuse — gone,
  deactivated, suspended, revoked — is refused and dropped from the list.

Share page (/watch)
- An IPv6 client is limited by its /64 (client_ip becomes client_key, for
  every limiter): keyed on the full address, one subscriber could rotate
  through endless identities. The comments now state what the per-link
  ceiling costs: guessing from five networks can keep a link shut for its
  window, and guesses already running when it fills are still checked.
- The link is looked up before the limiter records the attempt, so made-up
  tokens no longer grow it by an entry each.

Forms
- Failing the same way twice is announced again: the sign-in, passphrase
  and setup errors are keyed on the attempt (a clear and a set in one
  handler left the alert node untouched).
- The install wizard's own validation showed the generic error — it threw
  plain objects its catch did not read. It sets the step's message.

Tests: a re-pin leaving the previous account's notices behind; the pin
hand-over; switching to an ended account; the /64 viewer; made-up tokens;
the repeated alerts. Each mutation-checked RED for its own reason.

backend/app/routes/public.py

@@ -17,17 +17,20 @@ from app.db import get_db
 from app.downloads import links as linksmod
 from app.downloads import storage
 from app.models import DownloadJob, DownloadLink, MediaAsset
-from app.ratelimit import RateLimiter, client_ip
+from app.ratelimit import RateLimiter, client_key
 from app.security import verify_password
 
 router = APIRouter(prefix="/api/public", tags=["public"])
 
 # Slow password guessing on a link (the token itself is 192-bit, so it needs no throttle). Counted per
-# viewer — the link AND the client — so someone who has the link but not its password can't lock out the
-# viewers who do, and a busy link's own unlocks don't count against its next viewer.
+# viewer — the link AND the client (`client_key`) — so a client guessing wrong shuts out only itself, and a
+# busy link's own unlocks don't count against its next viewer.
 _unlock_limit = RateLimiter(max_events=10, window_seconds=300)
 # ...under a ceiling on WRONG passwords for the link from every client together, so guessing spread over
-# many addresses stays slow too. Viewers who have the password never add to it.
+# many addresses stays slow too; unlocking with the password never adds to it. The price of the ceiling:
+# someone with the link but not its password, guessing from 50 / 10 = 5 networks, can keep the link shut
+# for everyone until the window passes. It is checked before the password and counted after it, so guesses
+# already running when it fills are still checked — as many as the route's threadpool runs at once.
 _unlock_failures = RateLimiter(max_events=50, window_seconds=300)
 
 
@@ -92,10 +95,12 @@ def watch_unlock(
     token: str, body: WatchUnlockIn, request: Request, db: Session = Depends(get_db)
 ) -> dict:
     """Exchange the link password for a signed grant carried by the media URL."""
-    viewer = f"{token}|{client_ip(request)}"
+    # The link first: a token naming none must leave no limiter entry behind, or posting made-up tokens
+    # would grow the limiter without bound.
+    link = _link_or_404(db, token)
+    viewer = f"{token}|{client_key(request)}"
     if _unlock_failures.exhausted(token) or not _unlock_limit.allow(viewer):
         raise HTTPException(status_code=429, detail="Too many attempts. Try again later.")
-    link = _link_or_404(db, token)
     if not link.password_hash:
         # Not a password link — nothing to unlock; just hand back the plain meta.
         job, asset = _ready_target(db, link)