fix: review round 4 — an account switch unloads as the old account, a share link's lockout costs five networks

Deep-review round 4, targeted at round 3's changes (f569b19c..e7f38396).

Accounts
- Switching, adding or signing out an account moved the tab's pin before
  the page unloaded, so the players' resume beacons fired on the way out
  under the NEW account: one account's playback position saved into the
  other. The pin is now handed to the next page (pinOnNextPage) and taken
  over at import; clearActiveAccount is gone.
- Switching to a suspended account was refused but left it in the
  switcher, refused on every click; a deactivated one was not refused at
  all, and made the default it signed every account in the browser out on
  the next request. Every account _session_user would refuse — gone,
  deactivated, suspended, revoked — is refused and dropped from the list.

Share page (/watch)
- An IPv6 client is limited by its /64 (client_ip becomes client_key, for
  every limiter): keyed on the full address, one subscriber could rotate
  through endless identities. The comments now state what the per-link
  ceiling costs: guessing from five networks can keep a link shut for its
  window, and guesses already running when it fills are still checked.
- The link is looked up before the limiter records the attempt, so made-up
  tokens no longer grow it by an entry each.

Forms
- Failing the same way twice is announced again: the sign-in, passphrase
  and setup errors are keyed on the attempt (a clear and a set in one
  handler left the alert node untouched).
- The install wizard's own validation showed the generic error — it threw
  plain objects its catch did not read. It sets the step's message.

Tests: a re-pin leaving the previous account's notices behind; the pin
hand-over; switching to an ended account; the /64 viewer; made-up tokens;
the repeated alerts. Each mutation-checked RED for its own reason.

frontend/src/lib/accountPinnedStores.dom.test.ts

@@ -6,6 +6,24 @@
 // nobody's history, and the tab's first notice replaced the account's stored history with it.
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
+const entry = (id: number, message: string) => ({
+  id,
+  level: "info",
+  message,
+  ts: 1,
+  read: true,
+  dismissed: true,
+  transient: false,
+  repeat: 1,
+  requiresInteraction: false,
+});
+const storedMessages = (account: number) =>
+  (
+    JSON.parse(localStorage.getItem(`siftlode.notifications.${account}`) ?? "[]") as {
+      message: string;
+    }[]
+  ).map((n) => n.message);
+
 beforeEach(() => {
   localStorage.clear();
   sessionStorage.clear();
@@ -14,18 +32,7 @@ beforeEach(() => {
 
 describe("stores read at import, in a tab not yet pinned", () => {
   it("keep the account's notification history and settings once the tab is pinned", async () => {
-    const older = {
-      id: 7,
-      level: "info",
-      message: "older",
-      ts: 1,
-      read: true,
-      dismissed: true,
-      transient: false,
-      repeat: 1,
-      requiresInteraction: false,
-    };
-    localStorage.setItem("siftlode.notifications.5", JSON.stringify([older]));
+    localStorage.setItem("siftlode.notifications.5", JSON.stringify([entry(7, "older")]));
     localStorage.setItem("siftlode.notifSettings.5", JSON.stringify({ durationMs: 0 }));
     const notifications = await import("./notifications");
     const { setActiveAccount } = await import("./api/core");
@@ -34,10 +41,7 @@ describe("stores read at import, in a tab not yet pinned", () => {
     setActiveAccount(5);
     notifications.notify({ message: "after the pin" });
 
-    const stored = JSON.parse(localStorage.getItem("siftlode.notifications.5") ?? "[]") as {
-      message: string;
-    }[];
-    expect(stored.map((n) => n.message)).toEqual(["older", "before the pin", "after the pin"]);
+    expect(storedMessages(5)).toEqual(["older", "before the pin", "after the pin"]);
     expect(notifications.getNotifSettings().durationMs).toBe(0);
   });
 
@@ -51,3 +55,21 @@ describe("stores read at import, in a tab not yet pinned", () => {
     expect(hints.hintsEnabled()).toBe(false);
   });
 });
+
+describe("a pinned tab pinned to another account", () => {
+  it("leaves the previous account's notices with that account", async () => {
+    // BootGate moves a tab whose account was signed out elsewhere onto the one the server answers as.
+    sessionStorage.setItem("siftlode.activeAccount", "4");
+    localStorage.setItem("siftlode.notifications.4", JSON.stringify([entry(7, "four's")]));
+    localStorage.setItem("siftlode.notifications.5", JSON.stringify([entry(8, "five's")]));
+    const notifications = await import("./notifications");
+    const { setActiveAccount } = await import("./api/core");
+
+    notifications.notify({ message: "as four" });
+    setActiveAccount(5);
+    notifications.notify({ message: "as five" });
+
+    expect(storedMessages(5)).toEqual(["five's", "as five"]);
+    expect(storedMessages(4)).toEqual(["four's", "as four"]);
+  });
+});