fix: review round 4 — an account switch unloads as the old account, a share link's lockout costs five networks

Deep-review round 4, targeted at round 3's changes (f569b19c..e7f38396).

Accounts
- Switching, adding or signing out an account moved the tab's pin before
  the page unloaded, so the players' resume beacons fired on the way out
  under the NEW account: one account's playback position saved into the
  other. The pin is now handed to the next page (pinOnNextPage) and taken
  over at import; clearActiveAccount is gone.
- Switching to a suspended account was refused but left it in the
  switcher, refused on every click; a deactivated one was not refused at
  all, and made the default it signed every account in the browser out on
  the next request. Every account _session_user would refuse — gone,
  deactivated, suspended, revoked — is refused and dropped from the list.

Share page (/watch)
- An IPv6 client is limited by its /64 (client_ip becomes client_key, for
  every limiter): keyed on the full address, one subscriber could rotate
  through endless identities. The comments now state what the per-link
  ceiling costs: guessing from five networks can keep a link shut for its
  window, and guesses already running when it fills are still checked.
- The link is looked up before the limiter records the attempt, so made-up
  tokens no longer grow it by an entry each.

Forms
- Failing the same way twice is announced again: the sign-in, passphrase
  and setup errors are keyed on the attempt (a clear and a set in one
  handler left the alert node untouched).
- The install wizard's own validation showed the generic error — it threw
  plain objects its catch did not read. It sets the step's message.

Tests: a re-pin leaving the previous account's notices behind; the pin
hand-over; switching to an ended account; the /64 viewer; made-up tokens;
the repeated alerts. Each mutation-checked RED for its own reason.

frontend/src/lib/accountPinnedStores.dom.test.ts

@@ -6,6 +6,24 @@
 // nobody's history, and the tab's first notice replaced the account's stored history with it.
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
+const entry = (id: number, message: string) => ({
+  id,
+  level: "info",
+  message,
+  ts: 1,
+  read: true,
+  dismissed: true,
+  transient: false,
+  repeat: 1,
+  requiresInteraction: false,
+});
+const storedMessages = (account: number) =>
+  (
+    JSON.parse(localStorage.getItem(`siftlode.notifications.${account}`) ?? "[]") as {
+      message: string;
+    }[]
+  ).map((n) => n.message);
+
 beforeEach(() => {
   localStorage.clear();
   sessionStorage.clear();
@@ -14,18 +32,7 @@ beforeEach(() => {
 
 describe("stores read at import, in a tab not yet pinned", () => {
   it("keep the account's notification history and settings once the tab is pinned", async () => {
-    const older = {
-      id: 7,
-      level: "info",
-      message: "older",
-      ts: 1,
-      read: true,
-      dismissed: true,
-      transient: false,
-      repeat: 1,
-      requiresInteraction: false,
-    };
-    localStorage.setItem("siftlode.notifications.5", JSON.stringify([older]));
+    localStorage.setItem("siftlode.notifications.5", JSON.stringify([entry(7, "older")]));
     localStorage.setItem("siftlode.notifSettings.5", JSON.stringify({ durationMs: 0 }));
     const notifications = await import("./notifications");
     const { setActiveAccount } = await import("./api/core");
@@ -34,10 +41,7 @@ describe("stores read at import, in a tab not yet pinned", () => {
     setActiveAccount(5);
     notifications.notify({ message: "after the pin" });
 
-    const stored = JSON.parse(localStorage.getItem("siftlode.notifications.5") ?? "[]") as {
-      message: string;
-    }[];
-    expect(stored.map((n) => n.message)).toEqual(["older", "before the pin", "after the pin"]);
+    expect(storedMessages(5)).toEqual(["older", "before the pin", "after the pin"]);
     expect(notifications.getNotifSettings().durationMs).toBe(0);
   });
 
@@ -51,3 +55,21 @@ describe("stores read at import, in a tab not yet pinned", () => {
     expect(hints.hintsEnabled()).toBe(false);
   });
 });
+
+describe("a pinned tab pinned to another account", () => {
+  it("leaves the previous account's notices with that account", async () => {
+    // BootGate moves a tab whose account was signed out elsewhere onto the one the server answers as.
+    sessionStorage.setItem("siftlode.activeAccount", "4");
+    localStorage.setItem("siftlode.notifications.4", JSON.stringify([entry(7, "four's")]));
+    localStorage.setItem("siftlode.notifications.5", JSON.stringify([entry(8, "five's")]));
+    const notifications = await import("./notifications");
+    const { setActiveAccount } = await import("./api/core");
+
+    notifications.notify({ message: "as four" });
+    setActiveAccount(5);
+    notifications.notify({ message: "as five" });
+
+    expect(storedMessages(5)).toEqual(["five's", "as five"]);
+    expect(storedMessages(4)).toEqual(["four's", "as four"]);
+  });
+});

frontend/src/lib/activeAccount.dom.test.ts

@@ -0,0 +1,37 @@
+// @vitest-environment jsdom
+//
+// A switch or sign-out hands the tab's next page its account instead of moving the pin: the page being left
+// still unloads as its own account. The players' resume beacons read the pin as they fire on the way out,
+// and with the pin already moved they saved one account's playback position into the other.
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+beforeEach(() => {
+  sessionStorage.clear();
+  sessionStorage.setItem("siftlode.activeAccount", "3");
+  vi.resetModules(); // the hand-over is taken at import: each import below is a page load
+});
+
+describe("pinOnNextPage", () => {
+  it("leaves the pin alone until the next page, which takes the account over once", async () => {
+    const leaving = await import("./activeAccount");
+    leaving.pinOnNextPage(7);
+    expect(leaving.activeAccountId()).toBe(3); // the unload still acts as 3
+
+    vi.resetModules();
+    const next = await import("./activeAccount");
+    expect(next.activeAccountId()).toBe(7);
+
+    next.pinActiveAccount(9); // BootGate corrects it
+    vi.resetModules(); // and an F5 keeps the correction
+    expect((await import("./activeAccount")).activeAccountId()).toBe(9);
+  });
+
+  it("hands over no account at all, so the next page adopts the session's default", async () => {
+    const leaving = await import("./activeAccount");
+    leaving.pinOnNextPage(null);
+    expect(leaving.activeAccountId()).toBe(3);
+
+    vi.resetModules();
+    expect((await import("./activeAccount")).activeAccountId()).toBeNull();
+  });
+});

frontend/src/lib/activeAccount.ts

@@ -4,7 +4,8 @@
 // helpers that consume it.
 //
 // Deliberately NOT reactive: BootGate pins the account before any provider mounts, and a switch reloads
-// the page, so nothing mounted ever sees the id change underneath it. The one exception is state read at
+// the page (handing the new pin over through `pinOnNextPage`), so nothing mounted ever sees the id change
+// underneath it. The one exception is state read at
 // module import (the notification and hints stores), which in a new tab runs before the pin: it reads
 // again through `onAccountPinned`.
 //
@@ -27,6 +28,33 @@ export function pinActiveAccount(id: number): void {
   pinListeners.forEach((reload) => reload());
 }
 
+// The account the tab's NEXT page is pinned to, handed over by a switch or sign-out that is about to leave.
+// The pin itself stays until the page is gone: the unload still runs as the account the page was built for
+// (the players' resume beacons read the pin as they fire), and with the pin already moved it would save one
+// account's position into the other.
+const NEXT_ACCOUNT_KEY = "siftlode.nextAccount";
+
+/** Pin the tab's next page to `id` — or to none, so it adopts the session's default account. */
+export function pinOnNextPage(id: number | null): void {
+  try {
+    sessionStorage.setItem(NEXT_ACCOUNT_KEY, id == null ? "" : String(id));
+  } catch {
+    /* ignore */
+  }
+}
+
+// Taken over at import, before anything reads the pin.
+try {
+  const next = sessionStorage.getItem(NEXT_ACCOUNT_KEY);
+  if (next != null) {
+    sessionStorage.removeItem(NEXT_ACCOUNT_KEY);
+    if (next) sessionStorage.setItem(ACTIVE_ACCOUNT_KEY, next);
+    else sessionStorage.removeItem(ACTIVE_ACCOUNT_KEY);
+  }
+} catch {
+  /* ignore */
+}
+
 export function activeAccountId(): number | null {
   try {
     const raw = sessionStorage.getItem(ACTIVE_ACCOUNT_KEY);

frontend/src/lib/api.ts

@@ -11,19 +11,11 @@ import {
   getActiveAccount,
   HttpError,
   setActiveAccount,
-  clearActiveAccount,
   setUnauthorizedHandler,
 } from "./api/core";
 
 // Re-export the shared HTTP machinery so consumers keep importing these from "./api" unchanged.
-export {
-  alreadyReported,
-  HttpError,
-  getActiveAccount,
-  setActiveAccount,
-  clearActiveAccount,
-  setUnauthorizedHandler,
-};
+export { alreadyReported, HttpError, getActiveAccount, setActiveAccount, setUnauthorizedHandler };
 
 import { accountApi } from "./api/account";
 export type * from "./api/account";

frontend/src/lib/api/core.ts

@@ -6,7 +6,7 @@ import { getActiveToasts, notify, remove } from "../notifications";
 import i18n from "../../i18n";
 import { formatBytes } from "../format";
 import { reportError } from "../errorDialog";
-import { activeAccountId, ACTIVE_ACCOUNT_KEY, pinActiveAccount } from "../activeAccount";
+import { activeAccountId, pinActiveAccount } from "../activeAccount";
 
 /** The active UI language, as a bare code the server understands ("en"/"hu" — never "en-GB").
  *  Lives here so the request builders can stamp it themselves: a signal that has to be passed in by
@@ -263,13 +263,6 @@ export function beacon(url: string, body: Record<string, unknown>): void {
 }
 
 export const setActiveAccount = pinActiveAccount;
-export function clearActiveAccount(): void {
-  try {
-    sessionStorage.removeItem(ACTIVE_ACCOUNT_KEY);
-  } catch {
-    /* ignore */
-  }
-}
 
 export async function req<T = unknown>(
   url: string,