fix: review round 4 — an account switch unloads as the old account, a share link's lockout costs five networks

Deep-review round 4, targeted at round 3's changes (f569b19c..e7f38396).

Accounts
- Switching, adding or signing out an account moved the tab's pin before
  the page unloaded, so the players' resume beacons fired on the way out
  under the NEW account: one account's playback position saved into the
  other. The pin is now handed to the next page (pinOnNextPage) and taken
  over at import; clearActiveAccount is gone.
- Switching to a suspended account was refused but left it in the
  switcher, refused on every click; a deactivated one was not refused at
  all, and made the default it signed every account in the browser out on
  the next request. Every account _session_user would refuse — gone,
  deactivated, suspended, revoked — is refused and dropped from the list.

Share page (/watch)
- An IPv6 client is limited by its /64 (client_ip becomes client_key, for
  every limiter): keyed on the full address, one subscriber could rotate
  through endless identities. The comments now state what the per-link
  ceiling costs: guessing from five networks can keep a link shut for its
  window, and guesses already running when it fills are still checked.
- The link is looked up before the limiter records the attempt, so made-up
  tokens no longer grow it by an entry each.

Forms
- Failing the same way twice is announced again: the sign-in, passphrase
  and setup errors are keyed on the attempt (a clear and a set in one
  handler left the alert node untouched).
- The install wizard's own validation showed the generic error — it threw
  plain objects its catch did not read. It sets the step's message.

Tests: a re-pin leaving the previous account's notices behind; the pin
hand-over; switching to an ended account; the /64 viewer; made-up tokens;
the repeated alerts. Each mutation-checked RED for its own reason.

backend/tests/test_public_unlock_limit.py

@@ -1,7 +1,8 @@
 """The password unlock of a shared /watch link (routes/public.py), DB-lane.
 
-Guesses are slowed per viewer (the link AND the client), under a per-link ceiling on wrong passwords, so
-someone who holds a password link without its password can't lock out the viewers who have it.
+Guesses are slowed per viewer (the link AND the client — an IPv6 client by its /64), under a per-link
+ceiling on wrong passwords, so a client guessing wrong shuts out only itself until it spreads its guesses
+over as many networks as the ceiling allows.
 """
 
 import pytest
@@ -46,6 +47,26 @@ def test_a_link_holder_without_the_password_cannot_lock_out_its_viewers(unlock_u
     assert _from("198.51.100.7").post(unlock_url, json={"password": _PW}).status_code == 200
 
 
+def test_an_ipv6_client_is_one_viewer_across_its_64(unlock_url):
+    # One subscriber gets a whole /64: keyed on the full address, it could rotate through endless viewers.
+    for _ in range(10):
+        wrong = _from("2001:db8:1:2::5").post(unlock_url, json={"password": "guess"})
+        assert wrong.status_code == 403
+    assert _from("2001:db8:1:2::6").post(unlock_url, json={"password": _PW}).status_code == 429
+
+    assert _from("2001:db8:1:3::5").post(unlock_url, json={"password": _PW}).status_code == 200
+
+
+def test_a_token_naming_no_link_leaves_nothing_in_the_limiter(unlock_url):
+    # The limiter used to record the attempt before looking the link up: posting made-up tokens grew it by
+    # an entry each, kept for the whole window.
+    keys = len(public._unlock_limit._hits)
+    for n in range(5):
+        missing = _from("203.0.113.5").post(unlock_url.replace("/watch/", f"/watch/x{n}"), json={})
+        assert missing.status_code == 404
+    assert len(public._unlock_limit._hits) == keys
+
+
 def test_wrong_passwords_from_many_clients_still_reach_the_links_ceiling(unlock_url, monkeypatch):
     monkeypatch.setattr(public, "_unlock_failures", RateLimiter(max_events=3, window_seconds=300))
     viewer = _from("198.51.100.7")