Stop a fresh login from synthesizing a phantom migrated account

Signing in wrote `usesAccountLogin`, which syncs through key-value
storage independently of the account records. A device receiving that
flag before the account synthesized a migrated account for a login that
was never legacy — and the marker arriving later deliberately retracts
nothing, so the credential-less duplicate was permanent and uploaded.
The flag is pre-revamp state that migration only reads; accounts
describe logins now. `needsCredentials` reads the account list for any
instance that has one, so the badge it drives is unaffected.

A tombstone now dominates contexts as well as accounts: an offline
device can select an account another device deleted and publish that
choice with a newer timestamp, which would have left every device
pointing at an account that is never coming back.

Cached private feeds survived an Apple-account switch two ways. A scope
this device has seen before resolves while `CredentialIdentityScope` is
still being constructed, so the change notification fires before any
observer exists — startup now compares the persisted cache owner. And a
purge asked for before the disk cache is read was undone by the load,
which now carries it.

The need to re-bootstrap after dropping records for want of a resolved
identity is persisted. The engine may already have moved its token past
those records, so a launch that lost the in-memory flag would neither
replay nor bootstrap them.

Yattee/Services/HomeInstanceCache.swift

@@ -24,6 +24,10 @@ final class HomeInstanceCache {
     /// Whether the disk cache has been loaded.
     private var diskCacheLoaded = false
 
+    /// Set when feeds had to be dropped before the disk cache was read, so the
+    /// entries that load carry the same purge.
+    private var pendingFeedPurge = false
+
     private init() {}
 
     // MARK: - Cache Key Management
@@ -71,6 +75,11 @@ final class HomeInstanceCache {
         } else {
             LoggingService.shared.debug("No home instance cache found on disk", category: .general)
         }
+
+        if pendingFeedPurge {
+            pendingFeedPurge = false
+            clearAllFeeds()
+        }
     }
 
     /// Refreshes content from network for a specific instance and content type.
@@ -184,6 +193,19 @@ final class HomeInstanceCache {
     /// otherwise be served each other's. Popular and trending are public and
     /// stay.
     func clearAllFeeds() {
+        // A purge can be asked for before the disk cache has been read — the
+        // identity check runs at startup, the load is async. Dropping only what
+        // is in memory would then be undone by the load, so the requirement is
+        // remembered and applied to whatever it brings in.
+        guard diskCacheLoaded else {
+            pendingFeedPurge = true
+            LoggingService.shared.debug(
+                "HomeInstanceCache.clearAllFeeds: Deferred until the disk cache is loaded",
+                category: .general
+            )
+            return
+        }
+
         let keysToRemove = cache.keys.filter { $0.hasSuffix("_\(InstanceContentType.feed.rawValue)") }
         guard !keysToRemove.isEmpty else { return }