refactor(frontend): one account per browser, its local state under plain keys

The per-tab account pin, the X-Siftlode-Account header and ?account= go: the session cookie alone
says who is asking. localStorage keys lose their account suffix; the browser records whose state it
holds (siftlode.owner), BootGate hands it to the account the server answered as, and a different
account starts from a clean slate (the public /watch keys stay). The first boot moves the account's
old per-account copies onto the plain keys and drops other accounts' copies. Until the claim, and
after another tab claimed the browser for someone else, the account helpers read and write nothing.

The account panel lists no other accounts: "Add another account" becomes "Sign in as someone else"
(Google's account chooser; the pick replaces this account, a cancel keeps it), shown where Google
sign-in is configured.

frontend/src/lib/notifications.ts

@@ -2,8 +2,7 @@
 // the Notification Center shows (info events, actions awaiting interaction, and app
 // errors). History is persisted to localStorage so it survives reloads; action
 // callbacks are live-only and dropped on reload.
-import { activeAccountId, onAccountPinned } from "./activeAccount";
-import { LS, readAccount, readAccountMerged, writeAccount } from "./storage";
+import { LS, onLocalDataClaimed, readAccount, readAccountMerged, writeAccount } from "./storage";
 import { log, type Level } from "./log";
 
 // A notification's level in the client log: what the user was TOLD is part of the story a log tells.
@@ -226,18 +225,16 @@ function emit() {
 
 recompute();
 
-// The history and settings above are read at import, which in a new tab is before BootGate pins its
-// account — so they read as nobody's. Read them again for the account once it is pinned: otherwise the
-// tab's first write would replace the account's stored history with its own empty one. A notice raised
-// before the pin (a failed boot probe) belongs to no account, so it stays, after the history.
-let loadedFor = activeAccountId();
-onAccountPinned(() => {
-  const unpinned = loadedFor == null ? items : [];
-  loadedFor = activeAccountId();
+// The history and settings above are read at import, before BootGate knows the account — so they
+// read as nobody's. Read them again once the account is claimed (once per page: a different account
+// reloads it): otherwise the first write would replace the account's stored history with an empty one.
+// A notice raised before the claim (a failed boot probe) belongs to no account, so it stays, after the
+// history.
+onLocalDataClaimed(() => {
   config = loadSettings();
   // Fresh ids for the history: the notices kept may already hold the low ones (a timer, a producer).
   const history = load().map((n) => ({ ...n, id: counter++ }));
-  items = [...history, ...unpinned].slice(-MAX_HISTORY);
+  items = [...history, ...items].slice(-MAX_HISTORY);
   recompute();
   listeners.forEach((l) => l());
 });