fix: review round 4 — an account switch unloads as the old account, a share link's lockout costs five networks

Deep-review round 4, targeted at round 3's changes (f569b19c..e7f38396).

Accounts
- Switching, adding or signing out an account moved the tab's pin before
  the page unloaded, so the players' resume beacons fired on the way out
  under the NEW account: one account's playback position saved into the
  other. The pin is now handed to the next page (pinOnNextPage) and taken
  over at import; clearActiveAccount is gone.
- Switching to a suspended account was refused but left it in the
  switcher, refused on every click; a deactivated one was not refused at
  all, and made the default it signed every account in the browser out on
  the next request. Every account _session_user would refuse — gone,
  deactivated, suspended, revoked — is refused and dropped from the list.

Share page (/watch)
- An IPv6 client is limited by its /64 (client_ip becomes client_key, for
  every limiter): keyed on the full address, one subscriber could rotate
  through endless identities. The comments now state what the per-link
  ceiling costs: guessing from five networks can keep a link shut for its
  window, and guesses already running when it fills are still checked.
- The link is looked up before the limiter records the attempt, so made-up
  tokens no longer grow it by an entry each.

Forms
- Failing the same way twice is announced again: the sign-in, passphrase
  and setup errors are keyed on the attempt (a clear and a set in one
  handler left the alert node untouched).
- The install wizard's own validation showed the generic error — it threw
  plain objects its catch did not read. It sets the step's message.

Tests: a re-pin leaving the previous account's notices behind; the pin
hand-over; switching to an ended account; the /64 viewer; made-up tokens;
the repeated alerts. Each mutation-checked RED for its own reason.

frontend/src/components/SetupWizard.tsx

@@ -36,6 +36,9 @@ export default function SetupWizard() {
   const [stepIdx, setStepIdx] = useState(0);
   const [busy, setBusy] = useState(false);
   const [error, setError] = useState("");
+  // Keys the error: failing the same way twice is a new node, so a screen reader announces it again (a clear
+  // and a set in one handler commit together, leaving the node untouched).
+  const [attempt, setAttempt] = useState(0);
   // Admin account.
   const [email, setEmail] = useState("");
   const [password, setPassword] = useState("");
@@ -74,19 +77,21 @@ export default function SetupWizard() {
   };
 
   // Each step's "Next" action persists what it collected, then advances. Optional steps with empty
-  // fields just advance (skip). Errors surface inline (the setup calls use the quiet flag).
+  // fields just advance (skip). Errors surface inline (the setup calls use the quiet flag); a step's own
+  // validation sets its message and stays.
   async function next() {
+    setAttempt((n) => n + 1);
     setError("");
     setBusy(true);
     try {
       if (step === "admin") {
         if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email))
-          throw { detail: t("setup.admin.invalidEmail") };
+          return setError(t("setup.admin.invalidEmail"));
         if (password.length < PASSWORD_MIN)
-          throw { detail: t("setup.admin.shortPassword", { n: PASSWORD_MIN }) };
+          return setError(t("setup.admin.shortPassword", { n: PASSWORD_MIN }));
         await api.setupAdmin(token, email, password);
       } else if (step === "google" && (gid.trim() || gsecret.trim())) {
-        if (!gid.trim() || !gsecret.trim()) throw { detail: t("setup.google.bothRequired") };
+        if (!gid.trim() || !gsecret.trim()) return setError(t("setup.google.bothRequired"));
         await api.setupConfig(token, {
           google_client_id: gid.trim(),
           google_client_secret: gsecret.trim(),
@@ -268,7 +273,7 @@ export default function SetupWizard() {
           )}
 
           {error && (
-            <p role="alert" className="text-sm text-danger mt-3">
+            <p key={attempt} role="alert" className="text-sm text-danger mt-3">
               {error}
             </p>
           )}