fix(auth): a tab acts only as the account it was built for, and the review's other findings

A tab names the account it was claimed for on every request, beacon and upload
(X-Siftlode-Expect-Account); current_user and /auth/logout refuse a mismatch with
401 account_changed and keep the session, so a tab left showing the account
signed in before reloads instead of writing to the new one.

/auth/login clears a connect marker left by an abandoned connect, and a link
completes only on a session that still holds. The prefs merge reads the row
under a lock. A tab's sessionStorage records its own owner. A page the account
loses is given up, address bar and remembered page included. The panel layouts
are preferences; the storage contract also refuses a key handed to the Storage
API or to usePref outside its kind. A refused sign-in as someone else and a
failed sign-out say so. The chromium-only e2e specs are in the gate register,
the member walk waits for its requests, and devices.spec checks the save itself.

frontend/src/components/SavedViewsProvider.tsx

@@ -146,8 +146,8 @@ export function SavedViewsProvider({ children }: { children: ReactNode }) {
   // login effect (on a fresh browser the feed could seed DEFAULT_FILTERS and never re-apply until a
   // reload) — and it gives Plex the default it previously never applied at all. Per-source guard so a
   // 60s background refetch never re-seeds over the filters you're editing. canSeedDefault() reads the
-  // per-account stored-filters key, which is always readable here: BootGate pins the tab's account
-  // before this provider mounts.
+  // account's stored-filters key, which is always readable here: BootGate hands the browser's local
+  // state to the account (claimLocalData) before this provider mounts.
   const seededRef = useRef<Set<ViewSource>>(new Set());
   // `cfg` re-memoizes on every filter edit, so it is read through an effect event: the seed must
   // fire on the views query's first resolve for a source and never again, which `seededRef`