Fix account defects found in review

Five findings against the accounts layer, all real.

A fresh login created a random-UUID account and then flipped
usesAccountLogin, which posts instancesDidChange and re-ran legacy
reconciliation immediately. That guard only looked for an account whose ID
equalled the instance ID, so it synthesized a second, credential-less
account alongside the real one. Signing in now marks the instance migrated,
and reconciliation treats any account on an instance as evidence its login
is already represented.

save() set hasStoredContext, so the save inside reconcileLegacyAccounts
marked the still-default .local context as explicitly chosen and the
legacy-context migration that ran immediately after did nothing. Upgrading
users with a selected server account silently lost it. Only setContext,
applySyncedContext and the migration itself record a choice now.

An Apple Account change re-resolved the credential scope but never told
AccountsManager to reload its identity-namespaced storage - the only reload
was a one-time launch task - so the previous identity's accounts, context
and outbox stayed live under the new one, as did cached per-account
subscription providers. The scope now posts when its resolved value
changes; the accounts store reloads and the provider cache is dropped.

Fourteen call sites still read the pre-revamp instance-keyed Keychain item,
which a new login no longer writes: reopening the source screen showed the
account as signed out, and feed, browse, home and import operations treated
it as unauthenticated. They now resolve the credential through the account
layer, preferring the selected context's account and otherwise any
signed-in account on that instance.

Signing in while the identity scope was still unresolved created the
account in a temporary namespace that reloadForCurrentIdentity later
discards, while credential storage silently refused the write and the UI
reported success. Login is gated on a resolved scope and verifies the
credential actually stored before reporting success, rolling back a
newly-created account if it did not.

Yattee/Core/AccountsManager.swift

@@ -73,6 +73,16 @@ final class AccountsManager {
 
         load()
 
+        // A change of Apple Account changes which namespace this manager reads,
+        // so everything held in memory belongs to the previous one.
+        NotificationCenter.default.addObserver(
+            forName: .credentialIdentityScopeDidChange,
+            object: nil,
+            queue: .main
+        ) { [weak self] _ in
+            MainActor.assumeIsolated { self?.reloadForCurrentIdentity() }
+        }
+
         NotificationCenter.default.addObserver(
             forName: .instancesDidChange,
             object: nil,
@@ -139,6 +149,13 @@ final class AccountsManager {
         let account = Account(instanceID: instanceID, displayName: displayName)
         accounts.append(account)
         pendingUploads.insert(account.id)
+
+        // Signing in marks the instance migrated. Creating an account flips
+        // `usesAccountLogin`, which posts instancesDidChange and re-runs
+        // reconciliation immediately — without this the reconciliation would
+        // synthesize a second, credential-less account for the same instance.
+        migratedInstanceIDs.insert(instanceID)
+
         save()
         return account
     }
@@ -195,6 +212,7 @@ final class AccountsManager {
     /// Records an explicit user choice of context.
     func setContext(_ context: DataContext) {
         storedContext = StoredDataContext(context: context)
+        hasStoredContext = true
         save()
         NotificationCenter.default.post(name: .dataContextDidChange, object: nil)
     }
@@ -205,6 +223,7 @@ final class AccountsManager {
     func applySyncedContext(_ incoming: StoredDataContext) {
         guard incoming.changedAt > storedContext.changedAt else { return }
         storedContext = incoming
+        hasStoredContext = true
         save()
         NotificationCenter.default.post(name: .dataContextDidChange, object: nil)
     }
@@ -240,14 +259,19 @@ final class AccountsManager {
             guard instance.type.accountCapabilities.isSelectableContext else { continue }
             guard !migratedInstanceIDs.contains(instance.id) else { continue }
 
+            // Any account on this instance means its login is already
+            // represented — whether by an earlier migration or by a fresh
+            // sign-in. Synthesizing beside it would leave a credential-less
+            // duplicate.
+            guard accounts(forInstance: instance.id).isEmpty else {
+                migratedInstanceIDs.insert(instance.id)
+                didChange = true
+                continue
+            }
+
             migratedInstanceIDs.insert(instance.id)
             didChange = true
 
-            // Deterministic: the account reuses the instance UUID, so two
-            // devices migrating the same instance independently produce the
-            // identical record and merge instead of duplicating.
-            guard !accounts.contains(where: { $0.id == instance.id }) else { continue }
-
             let account = Account.migrated(from: instance.id, dateAdded: instance.dateAdded)
             accounts.append(account)
             pendingUploads.insert(account.id)
@@ -359,7 +383,6 @@ final class AccountsManager {
         }
         if let data = try? JSONEncoder().encode(storedContext) {
             defaults.set(data, forKey: key("context"))
-            hasStoredContext = true
         }
         defaults.set(migratedInstanceIDs.map(\.uuidString), forKey: key("migrated"))
         defaults.set(pendingUploads.map(\.uuidString), forKey: key("pendingUploads"))

Yattee/Core/AppEnvironment.swift

@@ -473,6 +473,36 @@ final class AppEnvironment {
         }
     }
 
+    /// The account whose credential should be used when talking to an instance.
+    ///
+    /// Prefers the account the user has selected as their context; otherwise any
+    /// signed-in account on that instance. Call sites that think in instances
+    /// rather than accounts — imports, feed fetches, browse — go through here
+    /// instead of the pre-revamp instance-keyed Keychain lookup, which a new
+    /// login no longer writes.
+    func account(forInstance instance: Instance) -> Account? {
+        if case let .account(id) = accountsManager.currentContext,
+           let account = accountsManager.account(id: id),
+           account.instanceID == instance.id {
+            return account
+        }
+
+        return accountsManager.accounts(forInstance: instance.id).first {
+            accountCredentialsManager(for: $0)?.isLoggedIn(for: $0) == true
+        }
+    }
+
+    /// The stored credential for an instance, resolved through its accounts.
+    func credential(forInstance instance: Instance) -> String? {
+        guard let account = account(forInstance: instance) else { return nil }
+        return accountCredentialsManager(for: account)?.credential(for: account)
+    }
+
+    /// Whether any account on this instance is signed in.
+    func isSignedIn(to instance: Instance) -> Bool {
+        credential(forInstance: instance) != nil
+    }
+
     /// Recomputes each account's status from the Keychain.
     ///
     /// Only ever reports `credentialMissing` versus `signedIn` — a rejected