fix(auth): a tab acts only as the account it was built for, and the review's other findings

A tab names the account it was claimed for on every request, beacon and upload
(X-Siftlode-Expect-Account); current_user and /auth/logout refuse a mismatch with
401 account_changed and keep the session, so a tab left showing the account
signed in before reloads instead of writing to the new one.

/auth/login clears a connect marker left by an abandoned connect, and a link
completes only on a session that still holds. The prefs merge reads the row
under a lock. A tab's sessionStorage records its own owner. A page the account
loses is given up, address bar and remembered page included. The panel layouts
are preferences; the storage contract also refuses a key handed to the Storage
API or to usePref outside its kind. A refused sign-in as someone else and a
failed sign-out say so. The chromium-only e2e specs are in the gate register,
the member walk waits for its requests, and devices.spec checks the save itself.

frontend/src/lib/log.ts

@@ -15,8 +15,10 @@
 // addresses. What a level ADDS (filter values at DEBUG, search strings at TRACE) is decided by the
 // call site asking `enabled(level)` before it builds the attribute.
 //
-// Dependency-free on purpose (only the build stamp): the request layer, the notification store and
-// the error boundary all log through here, so it must not import any of them.
+// Nearly dependency-free on purpose (the build stamp and the storage key registry, which import
+// nothing of the app at runtime): the request layer, the notification store and the error boundary
+// all log through here, so it must not import any of them, not even through another module
+// (logImports.contract.test.ts follows the runtime imports).
 import { LS } from "./storage";
 import { FRONTEND_VERSION } from "./version";