fix: review round 3 — a new tab keeps its account's notices, a revoked tab account lands on the default

Deep-review round 3 over main..improvement/watch-background-audio.

Account boot
- The notification history and settings, and the hints toggle, are read
  when their modules load, which in a new tab (bookmark, typed URL) is
  before BootGate pins the account: they read as nobody's, and the tab's
  first notice replaced the account's stored history (up to 100 entries)
  with a one-item list. They now read again when the tab is pinned
  (onAccountPinned, run by setActiveAccount); a notice raised before the
  pin stays, after the history.
- A tab pinned to an account still in this browser's wallet but whose
  session ended (suspended, deleted, or revoked by "log out everywhere")
  got "signed out" from /api/me while the default account was still
  signed in, and signing in again as anyone else left it there. A refused
  per-tab account now leaves the wallet, and the probe answers as the
  default, so the tab reloads onto it.

Share page (/watch)
- The password unlock is limited per viewer (link + client IP), under a
  per-link ceiling that counts only wrong passwords. Keyed on the link
  alone, ten wrong guesses every five minutes locked out every viewer,
  the ones with the password included. client_ip moves to app.ratelimit
  so the public routes can key on it.
- Its failure messages and the load-failure screen are announced
  (role=alert, the password input described by its error). The sign-in,
  passphrase, password-change and setup form errors get role=alert too.

Comments that still described removed machinery are corrected: App's
collapse flags, SettingsPanel's Save bar, ConfigPanel, authed_format_sig.

Tests: the account's history and hints across the pin; a revoked and a
suspended pinned account; the per-viewer limit and the ceiling; the
limiter's exhausted(); the share page's announced failures; a share
link's feed filters persisted. Each mutation-checked RED for its own
reason.

frontend/src/components/WatchPage.tsx

@@ -1,4 +1,4 @@
-import { useEffect, useRef, useState } from "react";
+import { useEffect, useId, useRef, useState } from "react";
 import { Download, File as FileIcon, Link2, Lock, PlayCircle, Repeat } from "lucide-react";
 import { Button } from "./ui/Button";
 import { formatBytes } from "../lib/format";
@@ -143,6 +143,7 @@ export default function WatchPage() {
   const [meta, setMeta] = useState<Meta | null>(null);
   const [password, setPassword] = useState("");
   const [error, setError] = useState<string | null>(null);
+  const errorId = useId();
   const [unlocking, setUnlocking] = useState(false);
   // One ref for whichever element renders (video or audio-only) — a callback ref so it can bind to
   // both without a per-element typed ref.
@@ -233,7 +234,9 @@ export default function WatchPage() {
         </div>
 
         {status === "loading" && (
-          <div className="flex-1 grid place-items-center text-muted">{T.loading}</div>
+          <div role="status" className="flex-1 grid place-items-center text-muted">
+            {T.loading}
+          </div>
         )}
 
         {status === "gone" && (
@@ -247,7 +250,8 @@ export default function WatchPage() {
 
         {status === "error" && (
           <div className="flex-1 grid place-items-center text-center">
-            <div>
+            {/* Announced: it replaces the loading line, and this page has no live region of its own. */}
+            <div role="alert">
               <div className="text-lg font-semibold">{T.failed}</div>
               <div className="text-sm text-muted mt-1">{T.failedHint}</div>
               <Button variant="primary" size="md" onClick={retry} className="mt-4">
@@ -270,9 +274,15 @@ export default function WatchPage() {
                 onChange={(e) => setPassword(e.target.value)}
                 onKeyDown={(e) => e.key === "Enter" && password && unlock()}
                 placeholder={T.passwordPlaceholder}
+                aria-describedby={error ? errorId : undefined}
                 className="w-full rounded-lg bg-surface border border-border px-3 py-2 text-sm outline-hidden focus:ring-2 focus:ring-accent/40"
               />
-              {error && <div className="text-sm text-danger mt-2">{error}</div>}
+              {/* Announced: focus stays in the input, so a silent message reads as a submit that did nothing. */}
+              {error && (
+                <div id={errorId} role="alert" className="text-sm text-danger mt-2">
+                  {error}
+                </div>
+              )}
               <Button
                 variant="primary"
                 size="md"