fix: review round 2 — a signed-out tab acts as nobody, honest share-page failures

Deep-review round 2 over main..improvement/watch-background-audio.

Account resolution (server)
- A request naming an account that is no longer signed in to this browser
  (X-Siftlode-Account or ?account=) now acts as nobody instead of the
  session's default account. A tab still pinned to an account signed out in
  another tab went on acting as the default: its player checkpoints and
  preference saves landed in that account, the messages socket and Plex
  playback ran as it, and its Sign out signed THAT account out. A hidden tab
  never polls /api/me, so a tab playing in the background kept doing it.
  The /api/me bootstrap probe alone keeps the fallback, which is how such a
  tab learns who it now is: the app's 401 handler reloads, and BootGate
  re-pins the tab.

BootGate
- On an identity change the tab reloads without moving its pin first. The
  tree being torn down still runs its unmount saves before the page goes,
  and with the pin already moved they wrote into the new account's local
  keys (a player volume still pending). The reloaded page corrects the pin.

Share page (/watch)
- Only a 404 says the link is gone. A 5xx, a dropped connection, and the
  unlock's own rate limit all rendered "no longer available ... expired or
  revoked" to a viewer with a valid link, with no way to try again. A load
  failure now offers Retry; too many password tries says so and keeps the
  form; an unlock that gets no answer says so instead of doing nothing.
  Strings in en/hu/de.

Downloads
- A cookie-authed asset is recognised under the current signature version
  and the one before it, so a job queued before a deploy that bumps the
  version still downloads with its cookie instead of failing on the login
  wall with an error that says no cookie was used.

The app chunk is preloaded through lazyWithPreload, so a failed fetch no
longer leaves an unhandled rejection beside the ErrorBoundary. The panel
layout seed is one helper (seedLayout).

Tests: the stale-tab refusal, its harmless Sign out and the probe fallback;
the pre-bump authed asset; BootGate keeping the pin on reload and staying
mounted through a same-account change; the reveal clock's later-commit
hand-off; the prefs, panel layout and demo-scope seeds from the me cache;
the share page's failure states. Each mutation-checked RED for its own
reason.

frontend/src/main.tsx

@@ -19,14 +19,14 @@ import { WizardProvider } from "./components/WizardProvider";
 import "./i18n";
 import "./index.css";
 import "flag-icons/css/flag-icons.min.css";
+import { lazyWithPreload } from "./lib/lazyWithPreload";
 
 // Split by top-level route so each entry point is its own chunk: a public /watch share link or a
 // legal page never downloads the authenticated app bundle, and the app never carries them either.
 // The legal pages live outside the App tree (no /api/me) so Google's consent screen and reviewers
 // can fetch them directly; the watch page is a login-free public player. Reached by full-page
 // navigation (plain <a href>), so a simple pathname switch is enough — no router needed.
-const loadApp = () => import("./App");
-const App = lazy(loadApp);
+const App = lazyWithPreload(() => import("./App"));
 const PrivacyPolicy = lazy(() => import("./components/legal/PrivacyPolicy"));
 const Terms = lazy(() => import("./components/legal/Terms"));
 const WatchPage = lazy(() => import("./components/WatchPage"));
@@ -43,8 +43,9 @@ de.scheme ||= "midnight";
 const path = window.location.pathname;
 const isPublicPage = path === "/privacy" || path === "/terms" || path.startsWith("/watch/");
 // Fetch the app chunk NOW, alongside BootGate's identity probe, instead of only once the gate opens:
-// the two waits then overlap rather than queue, and the gate usually opens straight onto the app.
-if (!isPublicPage) void loadApp();
+// the two waits then overlap rather than queue, and the gate usually opens straight onto the app. A
+// failed fetch is left to the render's own load, which retries it and reports to the ErrorBoundary.
+if (!isPublicPage) App.preload().catch(() => {});
 const root =
   path === "/privacy" ? (
     <PrivacyPolicy />