Resolve contexts and credentials through real accounts

Round two of review on the accounts layer.

The settings picker mapped its legacy instance-keyed selection straight
onto DataContext(legacy:), which turns an instance UUID into an account
UUID. That identity only holds for migrated accounts - a login created
after the revamp has a random ID - so selecting a freshly added account
named one that does not exist and left the provider nil. Selections now
resolve through AccountsManager to an actual account on that instance,
preferring a signed-in one. The picker still lists one entry per instance
and so cannot show a second login; the Phase 3 switcher replaces it.

BackgroundFeedRefresher was missed in the previous sweep because it
resolves credentials differently: it routed on the legacy setting and
looked up "first enabled Invidious instance" with an instance-keyed
credential. After any new-style login that silently found nothing and
skipped the refresh. It now routes on the selected context and takes the
credential from that account.

Subscription reads used the raw stored context, so an account waiting on
its instance or credential rendered empty instead of falling back to local
data as the tri-state design specifies. Reads go through the validator's
effective context; writes deliberately do not, so a subscribe fails
visibly rather than landing in local data the user did not choose.

Account statuses are cleared when the identity namespace reloads, but
nothing recomputed them once a deferred scope resolution succeeded - a
synced account kept showing "sign in required" until relaunch. The scope
change now triggers a refresh, deferred by one turn so it cannot depend on
observer registration order relative to the store's own reload.

Yattee/Core/AccountsManager.swift

@@ -209,6 +209,23 @@ final class AccountsManager {
 
     // MARK: - Context
 
+    /// Resolves a legacy instance-keyed selection onto a real account context.
+    ///
+    /// `DataContext(legacy:)` maps an instance UUID straight onto an account
+    /// UUID, which only holds for *migrated* accounts — those deliberately
+    /// reuse the instance UUID. A login created after the revamp has a random
+    /// ID, so the legacy mapping would name an account that does not exist.
+    func context(forLegacyInstanceID instanceID: UUID?) -> DataContext {
+        guard let instanceID else { return .local }
+
+        let candidates = accounts(forInstance: instanceID)
+        guard !candidates.isEmpty else { return .local }
+
+        // Prefer a signed-in account when the instance holds several.
+        let chosen = candidates.first { status(for: $0.id) == .signedIn } ?? candidates[0]
+        return .account(chosen.id)
+    }
+
     /// Records an explicit user choice of context.
     func setContext(_ context: DataContext) {
         storedContext = StoredDataContext(context: context)

Yattee/Core/AppEnvironment.swift

@@ -364,6 +364,24 @@ final class AppEnvironment {
         backfillCredentialFlags()
 
         dataContextValidator.setAppEnvironment(self)
+        subscriptionService.setContextValidator(dataContextValidator)
+
+        // Statuses are cleared whenever the identity namespace reloads, so they
+        // have to be recomputed once the new scope's Keychain is readable —
+        // otherwise a synced account shows "sign in required" until relaunch.
+        NotificationCenter.default.addObserver(
+            forName: .credentialIdentityScopeDidChange,
+            object: nil,
+            queue: .main
+        ) { [weak self] _ in
+            // Deferred rather than run inline: AccountsManager observes the same
+            // notification to reload its namespace and clear statuses, and
+            // relying on observer registration order to land after it would be
+            // silently fragile.
+            Task { @MainActor [weak self] in
+                self?.refreshAccountStatuses()
+            }
+        }
 
         // Turn any pre-revamp single-instance logins into accounts. Repeatable:
         // it runs again whenever instances arrive from iCloud.
@@ -492,6 +510,17 @@ final class AppEnvironment {
         }
     }
 
+    /// The selected context's account, when it lives on an instance of the
+    /// given type. Used by paths that still need to know which backend they are
+    /// talking to before they can build a request.
+    func account(forSelectedContext type: InstanceType) -> Account? {
+        guard case let .account(id) = accountsManager.currentContext,
+              let account = accountsManager.account(id: id),
+              accountsManager.instance(for: account)?.type == type
+        else { return nil }
+        return account
+    }
+
     /// The stored credential for an instance, resolved through its accounts.
     func credential(forInstance instance: Instance) -> String? {
         guard let account = account(forInstance: instance) else { return nil }