fix: review round 2 — a signed-out tab acts as nobody, honest share-page failures

Deep-review round 2 over main..improvement/watch-background-audio.

Account resolution (server)
- A request naming an account that is no longer signed in to this browser
  (X-Siftlode-Account or ?account=) now acts as nobody instead of the
  session's default account. A tab still pinned to an account signed out in
  another tab went on acting as the default: its player checkpoints and
  preference saves landed in that account, the messages socket and Plex
  playback ran as it, and its Sign out signed THAT account out. A hidden tab
  never polls /api/me, so a tab playing in the background kept doing it.
  The /api/me bootstrap probe alone keeps the fallback, which is how such a
  tab learns who it now is: the app's 401 handler reloads, and BootGate
  re-pins the tab.

BootGate
- On an identity change the tab reloads without moving its pin first. The
  tree being torn down still runs its unmount saves before the page goes,
  and with the pin already moved they wrote into the new account's local
  keys (a player volume still pending). The reloaded page corrects the pin.

Share page (/watch)
- Only a 404 says the link is gone. A 5xx, a dropped connection, and the
  unlock's own rate limit all rendered "no longer available ... expired or
  revoked" to a viewer with a valid link, with no way to try again. A load
  failure now offers Retry; too many password tries says so and keeps the
  form; an unlock that gets no answer says so instead of doing nothing.
  Strings in en/hu/de.

Downloads
- A cookie-authed asset is recognised under the current signature version
  and the one before it, so a job queued before a deploy that bumps the
  version still downloads with its cookie instead of failing on the login
  wall with an error that says no cookie was used.

The app chunk is preloaded through lazyWithPreload, so a failed fetch no
longer leaves an unhandled rejection beside the ErrorBoundary. The panel
layout seed is one helper (seedLayout).

Tests: the stale-tab refusal, its harmless Sign out and the probe fallback;
the pre-bump authed asset; BootGate keeping the pin on reload and staying
mounted through a same-account change; the reveal clock's later-commit
hand-off; the prefs, panel layout and demo-scope seeds from the me cache;
the share page's failure states. Each mutation-checked RED for its own
reason.

frontend/src/lib/panelLayout.dom.test.ts

@@ -0,0 +1,32 @@
+// @vitest-environment jsdom
+//
+// A panel's layout is seeded from the account's server prefs when the app mounts. The adopt effect this
+// replaced corrected it after mounting; with it gone, a seed that read only this browser's copy would
+// never show a layout changed on another device.
+import { beforeEach, describe, expect, it } from "vitest";
+import { seedLayout } from "./panelLayout";
+import { ACTIVE_ACCOUNT_KEY } from "./activeAccount";
+import { accountKey, LS } from "./storage";
+
+const local = { order: [], collapsed: { genre: true }, hidden: {} };
+
+beforeEach(() => {
+  localStorage.clear();
+  sessionStorage.setItem(ACTIVE_ACCOUNT_KEY, "5");
+  localStorage.setItem(accountKey(LS.plexLayout, 5)!, JSON.stringify(local));
+});
+
+describe("seedLayout", () => {
+  it("takes the account's server layout over this browser's copy", () => {
+    const l = seedLayout("plex", {
+      plexLayout: { order: [], collapsed: {}, hidden: { year: true } },
+    });
+    expect(l.hidden).toEqual({ year: true });
+    expect(l.collapsed).toEqual({});
+  });
+
+  it("uses this browser's copy for a layout the server has never stored", () => {
+    expect(seedLayout("plex", {}).collapsed).toEqual({ genre: true });
+    expect(seedLayout("plex", undefined).collapsed).toEqual({ genre: true });
+  });
+});

frontend/src/lib/panelLayout.ts

@@ -50,7 +50,7 @@ export function defaultLayout(panel: PanelId): PanelLayout {
   return { order: [...PANEL_ORDER[panel]], collapsed: {}, hidden: {} };
 }
 
-export function normalizeLayout(panel: PanelId, raw: unknown): PanelLayout {
+function normalizeLayout(panel: PanelId, raw: unknown): PanelLayout {
   const all = PANEL_ORDER[panel];
   const r = (raw ?? {}) as Partial<PanelLayout>;
   const order = Array.isArray(r.order) ? r.order.filter((x) => all.includes(x)) : [];
@@ -62,10 +62,20 @@ export function normalizeLayout(panel: PanelId, raw: unknown): PanelLayout {
   };
 }
 
-export function loadLayout(panel: PanelId): PanelLayout {
+function loadLayout(panel: PanelId): PanelLayout {
   return normalizeLayout(panel, readAccount<unknown>(LS_KEY[panel], {}));
 }
 
+// A panel's layout when the app mounts: the account's server copy (the `me` cache's preferences) when
+// it has one — so a layout changed on another device is right on the first paint — else this browser's.
+export function seedLayout(
+  panel: PanelId,
+  prefs: Record<string, unknown> | undefined,
+): PanelLayout {
+  const raw = prefs?.[PREF_KEY[panel]];
+  return raw ? normalizeLayout(panel, raw) : loadLayout(panel);
+}
+
 export function saveLayoutLocal(panel: PanelId, l: PanelLayout): void {
   writeAccount(LS_KEY[panel], l);
 }