Resolve contexts and credentials through real accounts

Round two of review on the accounts layer.

The settings picker mapped its legacy instance-keyed selection straight
onto DataContext(legacy:), which turns an instance UUID into an account
UUID. That identity only holds for migrated accounts - a login created
after the revamp has a random ID - so selecting a freshly added account
named one that does not exist and left the provider nil. Selections now
resolve through AccountsManager to an actual account on that instance,
preferring a signed-in one. The picker still lists one entry per instance
and so cannot show a second login; the Phase 3 switcher replaces it.

BackgroundFeedRefresher was missed in the previous sweep because it
resolves credentials differently: it routed on the legacy setting and
looked up "first enabled Invidious instance" with an instance-keyed
credential. After any new-style login that silently found nothing and
skipped the refresh. It now routes on the selected context and takes the
credential from that account.

Subscription reads used the raw stored context, so an account waiting on
its instance or credential rendered empty instead of falling back to local
data as the tri-state design specifies. Reads go through the validator's
effective context; writes deliberately do not, so a subscribe fails
visibly rather than landing in local data the user did not choose.

Account statuses are cleared when the identity namespace reloads, but
nothing recomputed them once a deferred scope resolution succeeded - a
synced account kept showing "sign in required" until relaunch. The scope
change now triggers a refresh, deferred by one turn so it cannot depend on
observer registration order relative to the store's own reload.

Yattee/Services/BackgroundRefresh/BackgroundFeedRefresher.swift

@@ -41,14 +41,32 @@ final class BackgroundFeedRefresher {
             return
         }
 
-        // Route based on subscription account type
-        switch appEnvironment.settingsManager.subscriptionAccount.type {
+        // Route on the selected data context. An account context resolves its
+        // own instance, so a second login on the same instance refreshes the
+        // right user's feed.
+        switch appEnvironment.accountsManager.currentContext {
         case .local:
             await performLocalAccountRefresh()
-        case .invidious:
-            await performInvidiousAccountRefresh()
-        case .piped:
-            await performPipedAccountRefresh()
+        case let .account(id):
+            guard let account = appEnvironment.accountsManager.account(id: id),
+                  let instance = appEnvironment.accountsManager.instance(for: account)
+            else {
+                LoggingService.shared.debug(
+                    "Background refresh skipped: selected account has no resolved instance",
+                    category: .notifications
+                )
+                return
+            }
+
+            switch instance.type {
+            case .invidious: await performInvidiousAccountRefresh()
+            case .piped: await performPipedAccountRefresh()
+            default:
+                LoggingService.shared.debug(
+                    "Background refresh not supported for this account type",
+                    category: .notifications
+                )
+            }
         }
     }
 
@@ -169,10 +187,12 @@ final class BackgroundFeedRefresher {
     private func performInvidiousAccountRefresh() async {
         guard let appEnvironment else { return }
 
-        // Require authenticated Invidious instance
-        guard let invidiousInstance = appEnvironment.instancesManager.instances
-            .first(where: { $0.type == .invidious && $0.isEnabled }),
-              let sid = appEnvironment.invidiousCredentialsManager.sid(for: invidiousInstance) else {
+        // Resolve through the selected account: a fresh login writes only the
+        // account-scoped Keychain key, and "first enabled Invidious instance"
+        // could pick a server this account has no credential for.
+        guard let account = appEnvironment.account(forSelectedContext: .invidious),
+              let invidiousInstance = appEnvironment.accountsManager.instance(for: account),
+              let sid = appEnvironment.accountCredentialsManager(for: account)?.credential(for: account) else {
             LoggingService.shared.debug("Background refresh requires authenticated Invidious instance", category: .notifications)
             return
         }
@@ -274,11 +294,9 @@ final class BackgroundFeedRefresher {
     private func performPipedAccountRefresh() async {
         guard let appEnvironment else { return }
 
-        // Get the instance ID from subscription account settings
-        let account = appEnvironment.settingsManager.subscriptionAccount
-        guard let instanceID = account.instanceID,
-              let pipedInstance = appEnvironment.instancesManager.instances.first(where: { $0.id == instanceID }),
-              let authToken = appEnvironment.pipedCredentialsManager.credential(for: pipedInstance) else {
+        guard let account = appEnvironment.account(forSelectedContext: .piped),
+              let pipedInstance = appEnvironment.accountsManager.instance(for: account),
+              let authToken = appEnvironment.accountCredentialsManager(for: account)?.credential(for: account) else {
             LoggingService.shared.debug("Background refresh requires authenticated Piped instance", category: .notifications)
             return
         }

Yattee/Services/SubscriptionService.swift

@@ -53,6 +53,7 @@ final class SubscriptionService {
     private var accountProviders: [UUID: any SubscriptionProvider] = [:]
 
     private weak var accountsManager: AccountsManager?
+    private weak var contextValidator: DataContextValidator?
 
     // MARK: - State
 
@@ -86,6 +87,10 @@ final class SubscriptionService {
         self.localProvider = LocalSubscriptionProvider(dataManager: dataManager)
     }
 
+    func setContextValidator(_ validator: DataContextValidator) {
+        contextValidator = validator
+    }
+
     func setAccountsManager(_ manager: AccountsManager) {
         accountsManager = manager
 
@@ -154,11 +159,25 @@ final class SubscriptionService {
         accountProviders[accountID] = nil
     }
 
-    /// Returns the current subscription provider for the selected context.
+    /// The provider for **writes**.
+    ///
+    /// Always the raw selected context, never the read fallback: a subscribe
+    /// must fail visibly when the account is unavailable rather than silently
+    /// landing in local data the user did not choose.
     var currentProvider: (any SubscriptionProvider)? {
         provider(for: currentContext)
     }
 
+    /// The provider for **reads**.
+    ///
+    /// Uses the validator's effective context, which falls back to local while
+    /// the selected account is waiting on its instance or credential. The
+    /// fallback is not persisted, so the user's choice takes effect again on
+    /// its own once the account resolves.
+    var readProvider: (any SubscriptionProvider)? {
+        provider(for: contextValidator?.effectiveContext ?? currentContext)
+    }
+
     /// The selected context, or `.local` before accounts have loaded.
     var currentContext: DataContext {
         accountsManager?.currentContext ?? .local
@@ -167,7 +186,7 @@ final class SubscriptionService {
     /// Subscription count for the active account, when known without a network fetch.
     /// Always available for local accounts; nil for server accounts until their cache is populated.
     var cachedSubscriptionCount: Int? {
-        currentProvider?.cachedSubscriptionCount
+        readProvider?.cachedSubscriptionCount
     }
 
     // MARK: - Subscribe
@@ -254,7 +273,7 @@ final class SubscriptionService {
     /// - Parameter channelID: The channel ID to check.
     /// - Returns: `true` if subscribed, `false` otherwise.
     func isSubscribed(to channelID: String) async -> Bool {
-        guard let provider = currentProvider else {
+        guard let provider = readProvider else {
             return false
         }
         return await provider.isSubscribed(to: channelID)
@@ -263,7 +282,7 @@ final class SubscriptionService {
     /// Fetches all subscriptions from the current provider.
     /// - Returns: Array of subscribed channels.
     func fetchSubscriptions() async throws -> [Channel] {
-        guard let provider = currentProvider else {
+        guard let provider = readProvider else {
             throw SubscriptionError.providerNotAvailable
         }
 
@@ -284,7 +303,7 @@ final class SubscriptionService {
     /// Synchronously fetches subscriptions for local provider.
     /// Returns nil if the current provider is not local (requires async fetch).
     func fetchSubscriptionsSync() -> [Channel]? {
-        guard currentContext.isLocal else {
+        guard (contextValidator?.effectiveContext ?? currentContext).isLocal else {
             return nil
         }
 
@@ -303,7 +322,7 @@ final class SubscriptionService {
 
     /// Refreshes the subscription cache from the current provider.
     func refreshCache() async throws {
-        guard let provider = currentProvider else {
+        guard let provider = readProvider else {
             throw SubscriptionError.providerNotAvailable
         }