fix(auth): a tab acts only as the account it was built for, and the review's other findings

A tab names the account it was claimed for on every request, beacon and upload
(X-Siftlode-Expect-Account); current_user and /auth/logout refuse a mismatch with
401 account_changed and keep the session, so a tab left showing the account
signed in before reloads instead of writing to the new one.

/auth/login clears a connect marker left by an abandoned connect, and a link
completes only on a session that still holds. The prefs merge reads the row
under a lock. A tab's sessionStorage records its own owner. A page the account
loses is given up, address bar and remembered page included. The panel layouts
are preferences; the storage contract also refuses a key handed to the Storage
API or to usePref outside its kind. A refused sign-in as someone else and a
failed sign-out say so. The chromium-only e2e specs are in the gate register,
the member walk waits for its requests, and devices.spec checks the save itself.

frontend/src/lib/removedFeatures.contract.test.ts

@@ -53,7 +53,9 @@ describe("removed features stay removed", () => {
   // One account per browser session (2026-10-20): the per-tab account pin, the header and `?account=`
   // that carried it, and the account list and switch went. A request naming an account would now
   // be ignored by the server, so a pin left behind reads as working while it does nothing. Only the
-  // claim that clears the old pin keys (storage.ts) and its test may name them.
+  // claim that clears the old pin keys (storage.ts) and its test may name them. (The tab's
+  // X-Siftlode-Expect-Account is not a pin: it never picks an account, the server refuses a request
+  // from a tab showing another one than the cookie's.)
   it("leaves no per-tab account pin, header or switch", { timeout: 30_000 }, () => {
     const PIN =
       /X-Siftlode-Account|activeAccount|nextAccount|[?&]account=|switchAccount|\/api\/me\/(accounts|switch)/i;