fix: review round 3 — a new tab keeps its account's notices, a revoked tab account lands on the default

Deep-review round 3 over main..improvement/watch-background-audio.

Account boot
- The notification history and settings, and the hints toggle, are read
  when their modules load, which in a new tab (bookmark, typed URL) is
  before BootGate pins the account: they read as nobody's, and the tab's
  first notice replaced the account's stored history (up to 100 entries)
  with a one-item list. They now read again when the tab is pinned
  (onAccountPinned, run by setActiveAccount); a notice raised before the
  pin stays, after the history.
- A tab pinned to an account still in this browser's wallet but whose
  session ended (suspended, deleted, or revoked by "log out everywhere")
  got "signed out" from /api/me while the default account was still
  signed in, and signing in again as anyone else left it there. A refused
  per-tab account now leaves the wallet, and the probe answers as the
  default, so the tab reloads onto it.

Share page (/watch)
- The password unlock is limited per viewer (link + client IP), under a
  per-link ceiling that counts only wrong passwords. Keyed on the link
  alone, ten wrong guesses every five minutes locked out every viewer,
  the ones with the password included. client_ip moves to app.ratelimit
  so the public routes can key on it.
- Its failure messages and the load-failure screen are announced
  (role=alert, the password input described by its error). The sign-in,
  passphrase, password-change and setup form errors get role=alert too.

Comments that still described removed machinery are corrected: App's
collapse flags, SettingsPanel's Save bar, ConfigPanel, authed_format_sig.

Tests: the account's history and hints across the pin; a revoked and a
suspended pinned account; the per-viewer limit and the ceiling; the
limiter's exhausted(); the share page's announced failures; a share
link's feed filters persisted. Each mutation-checked RED for its own
reason.

frontend/src/components/SettingsPanel.tsx

@@ -24,8 +24,8 @@ import { useMe } from "../lib/useMe";
 
 // The Settings page edits server-persisted preferences. Each change applies locally for instant
 // preview AND auto-saves (debounced) — no draft, no Save button; a small indicator flashes the
-// outcome. App owns the state + the save; this controller is
-// how the panel reads/writes it. See App.tsx.
+// outcome. PrefsProvider owns the state + the save; this controller
+// is how the panel reads/writes it.
 export type PrefsSaveState = SaveState;
 export interface PrefsController {
   theme: ThemePrefs;
@@ -128,8 +128,7 @@ function SaveIndicator({ state }: { state: PrefsSaveState }) {
 
 function Appearance({ prefs }: { prefs: PrefsController }) {
   const { t } = useTranslation();
-  // Controlled by App's prefs draft: each change applies locally for preview but is only
-  // persisted on an explicit Save (handled by the panel's Save/Discard bar).
+  // Controlled by PrefsProvider: each change applies locally at once and auto-saves (debounced).
   const { theme, setTheme, perf, setPerf, hints, setHints } = prefs;
   // The landing page (E24). Per-account localStorage, not a server preference like the rest of this
   // tab: `loadInitialPage` reads it synchronously in NavigationProvider's initializer. The two stored
@@ -252,8 +251,8 @@ function Appearance({ prefs }: { prefs: PrefsController }) {
 
 function Notifications({ prefs }: { prefs: PrefsController }) {
   const { t } = useTranslation();
-  // Controlled by App's prefs draft (live preview via configureNotifications there); the
-  // panel's Save bar persists it. The "send test" button below still fires immediately.
+  // Controlled by PrefsProvider (live preview via configureNotifications there), which auto-saves
+  // it. The "send test" button below fires immediately.
   const { notif: cfg, setNotif } = prefs;
   const update = (p: Partial<NotifSettings>) => setNotif({ ...cfg, ...p });
   const autoOn = cfg.durationMs > 0;
@@ -498,7 +497,11 @@ function SignInMethods({ me }: { me: Me }) {
               autoComplete="new-password"
               className={inputCls}
             />
-            {err && <p className="text-xs text-danger">{err}</p>}
+            {err && (
+              <p role="alert" className="text-xs text-danger">
+                {err}
+              </p>
+            )}
             <Button type="submit" variant="primary" size="sm" disabled={busy || !next}>
               {busy ? t("settings.account.password.saving") : t("settings.account.password.save")}
             </Button>