fix(auth): a Google connect names its tab's account too, and a refused tab says why

- /auth/google/connect is a navigation and carries no headers: the tab names the account it
  was built for in `expect`, checked by the same comparison as the request header
  (built_for_another_account); a mismatch lands on /?account=changed
- the link marker names the OAuth state of its own flow: an older flow coming back no longer
  spends the marker of the connect still open (which then returned as a plain sign-in)
- a 401 account_changed reloads the tab with a one-time flag, and the reloaded tab says it
  now shows the account signed in
- a refused switch to a suspended or not-yet-approved account says so in the signed-in
  app's words, naming the address a request was recorded for
- the prefs merge locks FOR NO KEY UPDATE, so a transaction that only added a row referring
  to the account does not hold the save up; a test pins the lock
- giving up a lost page closes a channel page open over it
- e2e README names the chromium-only specs

frontend/src/lib/useAccountSwitchNotice.dom.test.ts

@@ -0,0 +1,65 @@
+// @vitest-environment jsdom
+//
+// The app says what its entry URL tells the account signed in about a switch of account, once, and
+// only once that account is known. Without the hook in the shell, a refused switch or a tab that
+// reloaded as another account comes back without a word.
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { renderHook } from "@testing-library/react";
+
+vi.mock("react-i18next", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("react-i18next")>();
+  return {
+    ...actual,
+    useTranslation: () => ({
+      t: (key: string, values?: Record<string, string>) =>
+        values ? `${key} ${JSON.stringify(values)}` : key,
+      i18n: { language: "en" },
+    }),
+  };
+});
+const notifyMock = vi.fn();
+vi.mock("./notifications", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("./notifications")>();
+  return { ...actual, notify: (...a: unknown[]) => notifyMock(...a) };
+});
+const notice = vi.fn();
+vi.mock("./entryUrl", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("./entryUrl")>();
+  return { ...actual, accountSwitchNotice: () => notice() };
+});
+const { useAccountSwitchNotice } = await import("./useAccountSwitchNotice");
+
+afterEach(() => {
+  notifyMock.mockClear();
+  notice.mockReset();
+});
+
+describe("the shell's word on a switch of account", () => {
+  it("waits for the account, then says it once", () => {
+    notice.mockReturnValue({
+      level: "info",
+      key: "header.account.switchRequested",
+      values: { email: "b@example.com" },
+    });
+    const { rerender } = renderHook(({ signedIn }) => useAccountSwitchNotice(signedIn), {
+      initialProps: { signedIn: false },
+    });
+    expect(notifyMock).not.toHaveBeenCalled();
+
+    rerender({ signedIn: true });
+    rerender({ signedIn: false });
+    rerender({ signedIn: true });
+
+    expect(notifyMock).toHaveBeenCalledTimes(1);
+    expect(notifyMock).toHaveBeenCalledWith({
+      level: "info",
+      message: 'header.account.switchRequested {"email":"b@example.com"}',
+    });
+  });
+
+  it("says nothing when the entry URL has nothing to say", () => {
+    notice.mockReturnValue(null);
+    renderHook(() => useAccountSwitchNotice(true));
+    expect(notifyMock).not.toHaveBeenCalled();
+  });
+});