fix(auth): a Google connect names its tab's account too, and a refused tab says why

- /auth/google/connect is a navigation and carries no headers: the tab names the account it
  was built for in `expect`, checked by the same comparison as the request header
  (built_for_another_account); a mismatch lands on /?account=changed
- the link marker names the OAuth state of its own flow: an older flow coming back no longer
  spends the marker of the connect still open (which then returned as a plain sign-in)
- a 401 account_changed reloads the tab with a one-time flag, and the reloaded tab says it
  now shows the account signed in
- a refused switch to a suspended or not-yet-approved account says so in the signed-in
  app's words, naming the address a request was recorded for
- the prefs merge locks FOR NO KEY UPDATE, so a transaction that only added a row referring
  to the account does not hold the save up; a test pins the lock
- giving up a lost page closes a channel page open over it
- e2e README names the chromium-only specs

frontend/src/lib/useAccountSwitchNotice.ts

@@ -0,0 +1,19 @@
+import { useEffect, useRef } from "react";
+import { useTranslation } from "react-i18next";
+import { accountSwitchNotice } from "./entryUrl";
+import { notify } from "./notifications";
+
+/** Say, once per load, what the entry URL tells the account signed in here about a switch of
+ * account (`accountSwitchNotice`): a sign-in as someone else the server refused, or a tab that
+ * reloaded because another account signed in under it. It waits for the account — until it is
+ * known there is no one signed in to say it to. */
+export function useAccountSwitchNotice(signedIn: boolean): void {
+  const { t } = useTranslation();
+  const said = useRef(false);
+  useEffect(() => {
+    if (!signedIn || said.current) return;
+    said.current = true;
+    const notice = accountSwitchNotice();
+    if (notice) notify({ level: notice.level, message: t(notice.key, notice.values) });
+  }, [signedIn, t]);
+}