fix(auth): a tab acts only as the account it was built for, and the review's other findings

A tab names the account it was claimed for on every request, beacon and upload
(X-Siftlode-Expect-Account); current_user and /auth/logout refuse a mismatch with
401 account_changed and keep the session, so a tab left showing the account
signed in before reloads instead of writing to the new one.

/auth/login clears a connect marker left by an abandoned connect, and a link
completes only on a session that still holds. The prefs merge reads the row
under a lock. A tab's sessionStorage records its own owner. A page the account
loses is given up, address bar and remembered page included. The panel layouts
are preferences; the storage contract also refuses a key handed to the Storage
API or to usePref outside its kind. A refused sign-in as someone else and a
failed sign-out say so. The chromium-only e2e specs are in the gate register,
the member walk waits for its requests, and devices.spec checks the save itself.

frontend/src/App.tsx

@@ -7,6 +7,7 @@ import { api, setUnauthorizedHandler, type Me } from "./lib/api";
 import { notifyActionError } from "./lib/actionErrors";
 import { setLanguage, type LangCode } from "./i18n";
 import { clearParams } from "./lib/urlState";
+import { refusedSwitchNotice } from "./lib/entryUrl";
 import {
   PREF_KEY,
   saveLayoutLocal,
@@ -230,6 +231,16 @@ export default function App() {
     if (signedIn) clearParams("access", "verify", "reset");
   }, [signedIn]);
 
+  // A sign-in as someone else that the server refused (an account not approved, or suspended) came
+  // back here as the account still signed in — say so, once.
+  const switchAnswered = useRef(false);
+  useEffect(() => {
+    if (!signedIn || switchAnswered.current) return;
+    switchAnswered.current = true;
+    const notice = refusedSwitchNotice();
+    if (notice) notify({ level: notice.level, message: t(notice.key) });
+  }, [signedIn, t]);
+
   // Any request that 401s means the session ended server-side. If we were signed in (cached
   // `me` is a user object), reload to the login page at once (also covers any click that hits
   // the API). Guarded on a cached user so a stray 401 while logged out (cached `me` is null)