Resolve contexts and credentials through real accounts

Round two of review on the accounts layer.

The settings picker mapped its legacy instance-keyed selection straight
onto DataContext(legacy:), which turns an instance UUID into an account
UUID. That identity only holds for migrated accounts - a login created
after the revamp has a random ID - so selecting a freshly added account
named one that does not exist and left the provider nil. Selections now
resolve through AccountsManager to an actual account on that instance,
preferring a signed-in one. The picker still lists one entry per instance
and so cannot show a second login; the Phase 3 switcher replaces it.

BackgroundFeedRefresher was missed in the previous sweep because it
resolves credentials differently: it routed on the legacy setting and
looked up "first enabled Invidious instance" with an instance-keyed
credential. After any new-style login that silently found nothing and
skipped the refresh. It now routes on the selected context and takes the
credential from that account.

Subscription reads used the raw stored context, so an account waiting on
its instance or credential rendered empty instead of falling back to local
data as the tri-state design specifies. Reads go through the validator's
effective context; writes deliberately do not, so a subscribe fails
visibly rather than landing in local data the user did not choose.

Account statuses are cleared when the identity namespace reloads, but
nothing recomputed them once a deferred scope resolution succeeded - a
synced account kept showing "sign in required" until relaunch. The scope
change now triggers a refresh, deferred by one turn so it cannot depend on
observer registration order relative to the store's own reload.

Yattee/Services/BackgroundRefresh/BackgroundFeedRefresher.swift

@@ -41,14 +41,32 @@ final class BackgroundFeedRefresher {
             return
         }
 
-        // Route based on subscription account type
-        switch appEnvironment.settingsManager.subscriptionAccount.type {
+        // Route on the selected data context. An account context resolves its
+        // own instance, so a second login on the same instance refreshes the
+        // right user's feed.
+        switch appEnvironment.accountsManager.currentContext {
         case .local:
             await performLocalAccountRefresh()
-        case .invidious:
-            await performInvidiousAccountRefresh()
-        case .piped:
-            await performPipedAccountRefresh()
+        case let .account(id):
+            guard let account = appEnvironment.accountsManager.account(id: id),
+                  let instance = appEnvironment.accountsManager.instance(for: account)
+            else {
+                LoggingService.shared.debug(
+                    "Background refresh skipped: selected account has no resolved instance",
+                    category: .notifications
+                )
+                return
+            }
+
+            switch instance.type {
+            case .invidious: await performInvidiousAccountRefresh()
+            case .piped: await performPipedAccountRefresh()
+            default:
+                LoggingService.shared.debug(
+                    "Background refresh not supported for this account type",
+                    category: .notifications
+                )
+            }
         }
     }
 
@@ -169,10 +187,12 @@ final class BackgroundFeedRefresher {
     private func performInvidiousAccountRefresh() async {
         guard let appEnvironment else { return }
 
-        // Require authenticated Invidious instance
-        guard let invidiousInstance = appEnvironment.instancesManager.instances
-            .first(where: { $0.type == .invidious && $0.isEnabled }),
-              let sid = appEnvironment.invidiousCredentialsManager.sid(for: invidiousInstance) else {
+        // Resolve through the selected account: a fresh login writes only the
+        // account-scoped Keychain key, and "first enabled Invidious instance"
+        // could pick a server this account has no credential for.
+        guard let account = appEnvironment.account(forSelectedContext: .invidious),
+              let invidiousInstance = appEnvironment.accountsManager.instance(for: account),
+              let sid = appEnvironment.accountCredentialsManager(for: account)?.credential(for: account) else {
             LoggingService.shared.debug("Background refresh requires authenticated Invidious instance", category: .notifications)
             return
         }
@@ -274,11 +294,9 @@ final class BackgroundFeedRefresher {
     private func performPipedAccountRefresh() async {
         guard let appEnvironment else { return }
 
-        // Get the instance ID from subscription account settings
-        let account = appEnvironment.settingsManager.subscriptionAccount
-        guard let instanceID = account.instanceID,
-              let pipedInstance = appEnvironment.instancesManager.instances.first(where: { $0.id == instanceID }),
-              let authToken = appEnvironment.pipedCredentialsManager.credential(for: pipedInstance) else {
+        guard let account = appEnvironment.account(forSelectedContext: .piped),
+              let pipedInstance = appEnvironment.accountsManager.instance(for: account),
+              let authToken = appEnvironment.accountCredentialsManager(for: account)?.credential(for: account) else {
             LoggingService.shared.debug("Background refresh requires authenticated Piped instance", category: .notifications)
             return
         }