fix: review round 4 — an account switch unloads as the old account, a share link's lockout costs five networks

Deep-review round 4, targeted at round 3's changes (f569b19c..e7f38396).

Accounts
- Switching, adding or signing out an account moved the tab's pin before
  the page unloaded, so the players' resume beacons fired on the way out
  under the NEW account: one account's playback position saved into the
  other. The pin is now handed to the next page (pinOnNextPage) and taken
  over at import; clearActiveAccount is gone.
- Switching to a suspended account was refused but left it in the
  switcher, refused on every click; a deactivated one was not refused at
  all, and made the default it signed every account in the browser out on
  the next request. Every account _session_user would refuse — gone,
  deactivated, suspended, revoked — is refused and dropped from the list.

Share page (/watch)
- An IPv6 client is limited by its /64 (client_ip becomes client_key, for
  every limiter): keyed on the full address, one subscriber could rotate
  through endless identities. The comments now state what the per-link
  ceiling costs: guessing from five networks can keep a link shut for its
  window, and guesses already running when it fills are still checked.
- The link is looked up before the limiter records the attempt, so made-up
  tokens no longer grow it by an entry each.

Forms
- Failing the same way twice is announced again: the sign-in, passphrase
  and setup errors are keyed on the attempt (a clear and a set in one
  handler left the alert node untouched).
- The install wizard's own validation showed the generic error — it threw
  plain objects its catch did not read. It sets the step's message.

Tests: a re-pin leaving the previous account's notices behind; the pin
hand-over; switching to an ended account; the /64 viewer; made-up tokens;
the repeated alerts. Each mutation-checked RED for its own reason.

frontend/src/components/NavSidebar.tsx

@@ -4,7 +4,8 @@ import { useTranslation } from "react-i18next";
 import { useQuery } from "@tanstack/react-query";
 import { useNavigation, useNavigationActions } from "./NavigationProvider";
 import { Info, LogOut, Settings, Shield, UserPlus, type LucideIcon } from "lucide-react";
-import { api, clearActiveAccount, setActiveAccount, type Me } from "../lib/api";
+import { api, type Me } from "../lib/api";
+import { pinOnNextPage } from "../lib/activeAccount";
 import * as e2ee from "../lib/e2ee";
 import { useLiveQuery } from "../lib/useLiveQuery";
 import { getUnreadCount, subscribe } from "../lib/notifications";
@@ -71,7 +72,7 @@ export default function NavSidebar({
     } catch {
       /* IndexedDB unavailable (e.g. private mode) — never let it block the logout + reload */
     }
-    clearActiveAccount();
+    pinOnNextPage(null);
     location.reload();
   }
 
@@ -86,8 +87,9 @@ export default function NavSidebar({
   function switchTo(id: number) {
     // Per-tab switch: point THIS tab at the account and reload; other tabs keep their own
     // identity. No server round-trip — req() sends the account header (validated against the
-    // browser wallet server-side), so the cookie's default account is left untouched.
-    setActiveAccount(id);
+    // browser wallet server-side), so the cookie's default account is left untouched. The pin moves with
+    // the reload, not before it: the page going away still unloads as the account it was built for.
+    pinOnNextPage(id);
     // Drop the previous account's in-module sub-view/overlay before the reload (which would
     // otherwise preserve history.state across the swap). Otherwise the new account lands on a
     // stale sub-view — e.g. an open chat thread whose partnerId belongs to the OLD identity
@@ -334,7 +336,7 @@ export default function NavSidebar({
                     // Adding an account switches THIS tab to it: drop the tab's pin so that on
                     // return from Google it adopts the freshly-added account (the new default)
                     // and pins that. Other tabs keep their own pinned account.
-                    clearActiveAccount();
+                    pinOnNextPage(null);
                     window.location.href = "/auth/login";
                   }}
                   className="selectable w-full flex items-center gap-2 text-sm px-2 py-2 rounded-lg text-muted hover:text-fg hover:bg-card transition"