fix: review round 4 — an account switch unloads as the old account, a share link's lockout costs five networks

Deep-review round 4, targeted at round 3's changes (f569b19c..e7f38396).

Accounts
- Switching, adding or signing out an account moved the tab's pin before
  the page unloaded, so the players' resume beacons fired on the way out
  under the NEW account: one account's playback position saved into the
  other. The pin is now handed to the next page (pinOnNextPage) and taken
  over at import; clearActiveAccount is gone.
- Switching to a suspended account was refused but left it in the
  switcher, refused on every click; a deactivated one was not refused at
  all, and made the default it signed every account in the browser out on
  the next request. Every account _session_user would refuse — gone,
  deactivated, suspended, revoked — is refused and dropped from the list.

Share page (/watch)
- An IPv6 client is limited by its /64 (client_ip becomes client_key, for
  every limiter): keyed on the full address, one subscriber could rotate
  through endless identities. The comments now state what the per-link
  ceiling costs: guessing from five networks can keep a link shut for its
  window, and guesses already running when it fills are still checked.
- The link is looked up before the limiter records the attempt, so made-up
  tokens no longer grow it by an entry each.

Forms
- Failing the same way twice is announced again: the sign-in, passphrase
  and setup errors are keyed on the attempt (a clear and a set in one
  handler left the alert node untouched).
- The install wizard's own validation showed the generic error — it threw
  plain objects its catch did not read. It sets the step's message.

Tests: a re-pin leaving the previous account's notices behind; the pin
hand-over; switching to an ended account; the /64 viewer; made-up tokens;
the repeated alerts. Each mutation-checked RED for its own reason.

frontend/src/lib/activeAccount.ts

@@ -4,7 +4,8 @@
 // helpers that consume it.
 //
 // Deliberately NOT reactive: BootGate pins the account before any provider mounts, and a switch reloads
-// the page, so nothing mounted ever sees the id change underneath it. The one exception is state read at
+// the page (handing the new pin over through `pinOnNextPage`), so nothing mounted ever sees the id change
+// underneath it. The one exception is state read at
 // module import (the notification and hints stores), which in a new tab runs before the pin: it reads
 // again through `onAccountPinned`.
 //
@@ -27,6 +28,33 @@ export function pinActiveAccount(id: number): void {
   pinListeners.forEach((reload) => reload());
 }
 
+// The account the tab's NEXT page is pinned to, handed over by a switch or sign-out that is about to leave.
+// The pin itself stays until the page is gone: the unload still runs as the account the page was built for
+// (the players' resume beacons read the pin as they fire), and with the pin already moved it would save one
+// account's position into the other.
+const NEXT_ACCOUNT_KEY = "siftlode.nextAccount";
+
+/** Pin the tab's next page to `id` — or to none, so it adopts the session's default account. */
+export function pinOnNextPage(id: number | null): void {
+  try {
+    sessionStorage.setItem(NEXT_ACCOUNT_KEY, id == null ? "" : String(id));
+  } catch {
+    /* ignore */
+  }
+}
+
+// Taken over at import, before anything reads the pin.
+try {
+  const next = sessionStorage.getItem(NEXT_ACCOUNT_KEY);
+  if (next != null) {
+    sessionStorage.removeItem(NEXT_ACCOUNT_KEY);
+    if (next) sessionStorage.setItem(ACTIVE_ACCOUNT_KEY, next);
+    else sessionStorage.removeItem(ACTIVE_ACCOUNT_KEY);
+  }
+} catch {
+  /* ignore */
+}
+
 export function activeAccountId(): number | null {
   try {
     const raw = sessionStorage.getItem(ACTIVE_ACCOUNT_KEY);