fix(auth): a tab acts only as the account it was built for, and the review's other findings

A tab names the account it was claimed for on every request, beacon and upload
(X-Siftlode-Expect-Account); current_user and /auth/logout refuse a mismatch with
401 account_changed and keep the session, so a tab left showing the account
signed in before reloads instead of writing to the new one.

/auth/login clears a connect marker left by an abandoned connect, and a link
completes only on a session that still holds. The prefs merge reads the row
under a lock. A tab's sessionStorage records its own owner. A page the account
loses is given up, address bar and remembered page included. The panel layouts
are preferences; the storage contract also refuses a key handed to the Storage
API or to usePref outside its kind. A refused sign-in as someone else and a
failed sign-out say so. The chromium-only e2e specs are in the gate register,
the member walk waits for its requests, and devices.spec checks the save itself.

frontend/src/lib/api/expectedAccount.contract.test.ts

@@ -0,0 +1,19 @@
+import { readFileSync } from "node:fs";
+import { describe, expect, it } from "vitest";
+
+// A tab names the account it was built for, and the server refuses a request from a tab showing
+// another one than the cookie's. Spelled on both sides, so nothing but this test notices a rename:
+// the server would see no header, and a tab left showing the previous account would act as the new
+// one without a word.
+const read = (path: string) => readFileSync(new URL(path, import.meta.url), "utf-8");
+const AUTH = read("../../../../backend/app/auth.py");
+const CORE = read("./core.ts");
+
+describe("the account a tab was built for", () => {
+  it("is the header the server checks", () => {
+    const backend = /^EXPECTED_ACCOUNT_HEADER = "([^"]+)"$/m.exec(AUTH)?.[1];
+    const frontend = /^const EXPECTED_ACCOUNT_HEADER = "([^"]+)";$/m.exec(CORE)?.[1];
+    expect(backend).toBeTruthy();
+    expect(backend).toBe(frontend?.toLowerCase());
+  });
+});