fix: review round 3 — a new tab keeps its account's notices, a revoked tab account lands on the default

Deep-review round 3 over main..improvement/watch-background-audio.

Account boot
- The notification history and settings, and the hints toggle, are read
  when their modules load, which in a new tab (bookmark, typed URL) is
  before BootGate pins the account: they read as nobody's, and the tab's
  first notice replaced the account's stored history (up to 100 entries)
  with a one-item list. They now read again when the tab is pinned
  (onAccountPinned, run by setActiveAccount); a notice raised before the
  pin stays, after the history.
- A tab pinned to an account still in this browser's wallet but whose
  session ended (suspended, deleted, or revoked by "log out everywhere")
  got "signed out" from /api/me while the default account was still
  signed in, and signing in again as anyone else left it there. A refused
  per-tab account now leaves the wallet, and the probe answers as the
  default, so the tab reloads onto it.

Share page (/watch)
- The password unlock is limited per viewer (link + client IP), under a
  per-link ceiling that counts only wrong passwords. Keyed on the link
  alone, ten wrong guesses every five minutes locked out every viewer,
  the ones with the password included. client_ip moves to app.ratelimit
  so the public routes can key on it.
- Its failure messages and the load-failure screen are announced
  (role=alert, the password input described by its error). The sign-in,
  passphrase, password-change and setup form errors get role=alert too.

Comments that still described removed machinery are corrected: App's
collapse flags, SettingsPanel's Save bar, ConfigPanel, authed_format_sig.

Tests: the account's history and hints across the pin; a revoked and a
suspended pinned account; the per-viewer limit and the ceiling; the
limiter's exhausted(); the share page's announced failures; a share
link's feed filters persisted. Each mutation-checked RED for its own
reason.

frontend/src/components/WatchPage.dom.test.tsx

@@ -147,6 +147,7 @@ describe("WatchPage honest failures", () => {
     const page = render(<WatchPage />);
     const retry = await page.findByRole("button", { name: "Try again" });
     expect(page.queryByText(GONE)).toBeNull();
+    expect(page.getByRole("alert").textContent).toContain("Couldn't load this link.");
 
     fireEvent.click(retry);
     await waitFor(() => expect(page.container.querySelector("video")).not.toBeNull());
@@ -188,12 +189,18 @@ describe("WatchPage honest failures", () => {
     window.history.replaceState({}, "", "/watch/tok-429");
     const page = await tryPassword(async () => res(429));
     await page.findByText("Too many attempts. Try again in a few minutes.");
-    expect(page.getByPlaceholderText("Enter password")).toBeTruthy();
+    const alert = page.getByRole("alert");
+    expect(alert.textContent).toBe("Too many attempts. Try again in a few minutes.");
+    expect(page.getByPlaceholderText("Enter password").getAttribute("aria-describedby")).toBe(
+      alert.id,
+    );
   });
 
   it("an unlock that gets no answer says so instead of doing nothing", async () => {
     window.history.replaceState({}, "", "/watch/tok-unlock-offline");
     const page = await tryPassword(() => Promise.reject(new TypeError("Failed to fetch")));
-    await page.findByText("Couldn't check the password. Try again.");
+    expect((await page.findByRole("alert")).textContent).toBe(
+      "Couldn't check the password. Try again.",
+    );
   });
 });