Fence stale feed results and stop guessing at unknown account state

Signing in again keeps the account ID and the context, so a request
already in flight under the previous credential could land afterwards
and write that user's private feed back into the cache and onto disk.
Feed results now carry the account they were requested for and are
dropped if it has moved.

An account with no recorded status was reported as "sign in required".
While the identity scope is unresolved nothing can read the Keychain
under the right scope, so that is the absence of an answer, not one — on
a tokenless or first-seen Apple account it told users with working
logins to sign in again and dropped reads to local data. It is now a
state of its own.

Transport failures mark the account unreachable instead of leaving it
"signed in", which is what the documented local read fallback keys on.
Neither that nor a rejection is overwritten by the Keychain-based
refresh any more: only the server can clear what the server said.

Disabling sync deliberately does not rewrite Keychain items to local.
That means deleting them, and deleting a synchronizable item propagates
to every device — "stop syncing this login" would sign the user out
elsewhere, which is not what the toggle says. The reasoning is recorded
at the call site.

Yattee/Core/AccountsManager.swift

@@ -9,6 +9,12 @@ import Foundation
 
 /// Why an account cannot currently be used.
 enum AccountStatus: Hashable, Sendable {
+    /// Nothing is known yet — the Apple account this device's credentials are
+    /// keyed by has not been established, so the Keychain cannot be read under
+    /// the right scope. Distinct from `credentialMissing`, which is an answer:
+    /// this one is the absence of one, and must never be presented as "signed
+    /// out" or acted on.
+    case checking
     /// Signed in and usable.
     case signedIn
     /// No credential on this device. On tvOS this is permanent until the user
@@ -499,8 +505,14 @@ final class AccountsManager {
         NotificationCenter.default.post(name: .accountsDidChange, object: nil)
     }
 
+    /// An account with no recorded status is *unknown*, not signed out. While
+    /// the identity scope is unresolved nothing can read the Keychain under the
+    /// right scope, and reporting a missing credential then would tell a user
+    /// with a perfectly good login to sign in again — and drop reads to local
+    /// data — for as long as iCloud stayed unreachable.
     func status(for accountID: UUID) -> AccountStatus {
-        accountStatuses[accountID] ?? .credentialMissing
+        if let status = accountStatuses[accountID] { return status }
+        return identityScope.isResolved ? .credentialMissing : .checking
     }
 
     // MARK: - Legacy migration

Yattee/Core/AppEnvironment.swift

@@ -805,14 +805,17 @@ final class AppEnvironment {
                 continue
             }
 
-            // A credential the server has rejected is still a credential: only
-            // the server can say it works again. Reporting "signed in" here
-            // because the Keychain item exists would erase the rejection the
-            // moment it was recorded — the API layer sets it, which posts the
-            // notification that runs this — and the user would never be asked
-            // to sign in again. Storing a new credential resets the status
-            // explicitly.
-            guard accountsManager.status(for: account.id) != .credentialRejected else { continue }
+            // A credential the server rejected — or a server that could not be
+            // reached — is still a credential, and only the server can say
+            // otherwise. Reporting "signed in" here because the Keychain item
+            // exists would erase those the moment they were recorded: the API
+            // layer sets them, and that posts the notification that runs this.
+            // The next successful call clears them; storing a new credential
+            // resets the status explicitly.
+            switch accountsManager.status(for: account.id) {
+            case .credentialRejected, .unreachable: continue
+            case .checking, .signedIn, .credentialMissing: break
+            }
 
             accountsManager.setStatus(.signedIn, for: account.id)
         }