fix(auth): a tab acts only as the account it was built for, and the review's other findings

A tab names the account it was claimed for on every request, beacon and upload
(X-Siftlode-Expect-Account); current_user and /auth/logout refuse a mismatch with
401 account_changed and keep the session, so a tab left showing the account
signed in before reloads instead of writing to the new one.

/auth/login clears a connect marker left by an abandoned connect, and a link
completes only on a session that still holds. The prefs merge reads the row
under a lock. A tab's sessionStorage records its own owner. A page the account
loses is given up, address bar and remembered page included. The panel layouts
are preferences; the storage contract also refuses a key handed to the Storage
API or to usePref outside its kind. A refused sign-in as someone else and a
failed sign-out say so. The chromium-only e2e specs are in the gate register,
the member walk waits for its requests, and devices.spec checks the save itself.

frontend/src/lib/entryUrl.ts

@@ -14,6 +14,8 @@
 // names) — an email in a query string lands in every reverse-proxy access log. Plain status flags
 // with nothing personal in them (login, deleted) ride the query string.
 
+import type { NotifLevel } from "./notifications";
+
 export const entrySearch = new URLSearchParams(window.location.search);
 export const entryHash = new URLSearchParams(window.location.hash.replace(/^#/, ""));
 
@@ -58,3 +60,19 @@ export function clearEntryUrl(): void {
     `${window.location.pathname}${qs ? `?${qs}` : ""}${keep}`,
   );
 }
+
+/** What a sign-in as someone else that did not happen says to the account still signed in here. The
+ * callback answers a Google account that is not approved, or is suspended, without replacing the
+ * session, and with the flags the sign-in page reads; the signed-in app read none of them, so the
+ * person came back as before without a word. A request recorded on the way says so. */
+export function refusedSwitchNotice(
+  search: URLSearchParams = entrySearch,
+  hash: URLSearchParams = entryHash,
+): { level: NotifLevel; key: string } | null {
+  if (search.get("login") === "suspended")
+    return { level: "warning", key: "welcome.auth.suspended" };
+  const access = hash.get("access");
+  if (access === "requested") return { level: "info", key: "welcome.auth.accessRequested" };
+  if (access === "denied") return { level: "warning", key: "header.account.switchNotApproved" };
+  return null;
+}