fix(auth): a Google connect names its tab's account too, and a refused tab says why

- /auth/google/connect is a navigation and carries no headers: the tab names the account it
  was built for in `expect`, checked by the same comparison as the request header
  (built_for_another_account); a mismatch lands on /?account=changed
- the link marker names the OAuth state of its own flow: an older flow coming back no longer
  spends the marker of the connect still open (which then returned as a plain sign-in)
- a 401 account_changed reloads the tab with a one-time flag, and the reloaded tab says it
  now shows the account signed in
- a refused switch to a suspended or not-yet-approved account says so in the signed-in
  app's words, naming the address a request was recorded for
- the prefs merge locks FOR NO KEY UPDATE, so a transaction that only added a row referring
  to the account does not hold the save up; a test pins the lock
- giving up a lost page closes a channel page open over it
- e2e README names the chromium-only specs

frontend/src/lib/googleConnect.ts

@@ -1,13 +1,21 @@
 // Every in-app Google round-trip starts at one backend route (auth.py `google_connect`): attaching a
 // Google sign-in to the account (`identity`), or granting YouTube access on top (`read`, `write`).
 // The page navigates away to Google and comes back through the shared callback, which lands on
-// `?link=…` (App.tsx) for `identity` and on the app itself for a grant.
+// `?link=…` (App.tsx) for `identity` and on the app itself for a grant. A navigation carries no
+// headers, so it names the account the tab was built for in the query (`expect`) — the check every
+// request gets (`identityHeaders`): a tab still showing the account signed in before would otherwise
+// attach Google to the one signed in now.
+
+import { claimedAccount } from "./storage";
 
 export const GOOGLE_ACCESS = ["identity", "read", "write"] as const;
 export type GoogleAccess = (typeof GOOGLE_ACCESS)[number];
 
 export function googleConnectUrl(access: GoogleAccess): string {
-  return `/auth/google/connect?access=${access}`;
+  const params = new URLSearchParams({ access });
+  const account = claimedAccount();
+  if (account) params.set("expect", account);
+  return `/auth/google/connect?${params.toString()}`;
 }
 
 /** Leave for Google's sign-in or consent screen. */