fix(auth): a tab acts only as the account it was built for, and the review's other findings

A tab names the account it was claimed for on every request, beacon and upload
(X-Siftlode-Expect-Account); current_user and /auth/logout refuse a mismatch with
401 account_changed and keep the session, so a tab left showing the account
signed in before reloads instead of writing to the new one.

/auth/login clears a connect marker left by an abandoned connect, and a link
completes only on a session that still holds. The prefs merge reads the row
under a lock. A tab's sessionStorage records its own owner. A page the account
loses is given up, address bar and remembered page included. The panel layouts
are preferences; the storage contract also refuses a key handed to the Storage
API or to usePref outside its kind. A refused sign-in as someone else and a
failed sign-out say so. The chromium-only e2e specs are in the gate register,
the member walk waits for its requests, and devices.spec checks the save itself.

backend/app/auth.py

@@ -263,8 +263,26 @@ def stamp_session(request: Request, user: User) -> None:
     request.session["epoch"] = user.session_epoch or 0
 
 
+# The account a tab was built for, sent with every request it makes (`identityHeaders`, the
+# frontend). The cookie alone says who is asking, and one browser holds one account: a sign-in as
+# someone else in another tab replaces it under every open tab. A tab still showing the previous
+# account would otherwise act as the new one — its player checkpoints, pref saves, Sign out and
+# Delete account landing there — until it noticed. It never selects an account; a mismatch is
+# refused, and the tab reloads as whoever is signed in now.
+EXPECTED_ACCOUNT_HEADER = "x-siftlode-expect-account"
+
+
 def current_user(request: Request, db: Session = Depends(get_db)) -> User:
-    return _session_user(request, db, session_user_id(request))
+    user = _session_user(request, db, session_user_id(request))
+    expected = request.headers.get(EXPECTED_ACCOUNT_HEADER)
+    if expected is not None and expected != str(user.id):
+        # The session stays: it is the other tab's sign-in, and it holds.
+        log.info(
+            "a request from a tab built for another account was refused",
+            extra=logs.event("auth.session.account_changed", user_id=user.id),
+        )
+        raise refused(401, "account_changed")
+    return user
 
 
 def _session_user(request: Request, db: Session, user_id: int | None) -> User: