fix(auth): a tab acts only as the account it was built for, and the review's other findings

A tab names the account it was claimed for on every request, beacon and upload
(X-Siftlode-Expect-Account); current_user and /auth/logout refuse a mismatch with
401 account_changed and keep the session, so a tab left showing the account
signed in before reloads instead of writing to the new one.

/auth/login clears a connect marker left by an abandoned connect, and a link
completes only on a session that still holds. The prefs merge reads the row
under a lock. A tab's sessionStorage records its own owner. A page the account
loses is given up, address bar and remembered page included. The panel layouts
are preferences; the storage contract also refuses a key handed to the Storage
API or to usePref outside its kind. A refused sign-in as someone else and a
failed sign-out say so. The chromium-only e2e specs are in the gate register,
the member walk waits for its requests, and devices.spec checks the save itself.

frontend/src/lib/gates.contract.test.ts

@@ -412,6 +412,22 @@ describe("the gate register (docs/gates.md)", () => {
     expect(missingFrom(eslintNarrowings(await linted()))).toEqual([]);
   }, 120_000);
 
+  // A spec left out of the webkit and ipad projects runs on one engine only.
+  it("lists every e2e spec that runs on one engine only", () => {
+    const cfg = read("frontend/playwright.config.ts");
+    const alternatives = /const CHROMIUM_ONLY = \/\(([^)]+)\)\\.spec\\.ts\//.exec(cfg)?.[1];
+    expect(alternatives, "CHROMIUM_ONLY").toBeTruthy();
+    const found = alternatives!
+      .split("|")
+      .map((name): [string, string] => ["e2e", `${name}.spec.ts`]);
+    expect(missingFrom(found)).toEqual([]);
+    // Any other way of leaving a spec out of a project would be a narrowing this does not read.
+    expect([...cfg.matchAll(/testIgnore:\s*([^,\n]+)/g)].map((m) => m[1])).toEqual([
+      "CHROMIUM_ONLY",
+      "CHROMIUM_ONLY",
+    ]);
+  });
+
   it("keeps --max-warnings 0, which is what makes a warn-level rule fail", () => {
     const pkg = JSON.parse(read("frontend/package.json")) as { scripts: Record<string, string> };
     expect(pkg.scripts.lint).toBe("eslint . --max-warnings 0");