Fence stale feed results and stop guessing at unknown account state

Signing in again keeps the account ID and the context, so a request
already in flight under the previous credential could land afterwards
and write that user's private feed back into the cache and onto disk.
Feed results now carry the account they were requested for and are
dropped if it has moved.

An account with no recorded status was reported as "sign in required".
While the identity scope is unresolved nothing can read the Keychain
under the right scope, so that is the absence of an answer, not one — on
a tokenless or first-seen Apple account it told users with working
logins to sign in again and dropped reads to local data. It is now a
state of its own.

Transport failures mark the account unreachable instead of leaving it
"signed in", which is what the documented local read fallback keys on.
Neither that nor a rejection is overwritten by the Keychain-based
refresh any more: only the server can clear what the server said.

Disabling sync deliberately does not rewrite Keychain items to local.
That means deleting them, and deleting a synchronizable item propagates
to every device — "stop syncing this login" would sign the user out
elsewhere, which is not what the toggle says. The reasoning is recorded
at the call site.

Yattee/Views/Settings/InstanceAccountsSection.swift

@@ -153,11 +153,12 @@ struct InstanceAccountsSection: View {
     }
 
     private func status(for account: Account) -> AccountStatus {
-        appEnvironment?.accountsManager.status(for: account.id) ?? .credentialMissing
+        appEnvironment?.accountsManager.status(for: account.id) ?? .checking
     }
 
     private func statusText(for account: Account) -> String {
         switch status(for: account) {
+        case .checking: String(localized: "accounts.status.checking")
         case .signedIn: String(localized: "accounts.status.signedIn")
         case .credentialMissing: String(localized: "accounts.status.credentialMissing")
         case .credentialRejected: String(localized: "accounts.status.credentialRejected")
@@ -171,6 +172,7 @@ struct InstanceAccountsSection: View {
 
     private func statusColor(for account: Account) -> Color {
         switch status(for: account) {
+        case .checking: .secondary
         case .signedIn: .secondary
         case .credentialMissing: .secondary
         case .credentialRejected: .red

Yattee/Views/Settings/iCloudSettingsView.swift

@@ -532,11 +532,19 @@ struct iCloudSettingsView: View {
         resyncStoredLogins()
     }
 
-    /// Rewrites stored logins so they carry the sync setting that has just
-    /// changed. Whether a Keychain item syncs is fixed when it is written, so a
-    /// login stored while sync was off would stay on this device while its
+    /// Rewrites stored logins so they carry the sync setting that has just been
+    /// turned **on**. Whether a Keychain item syncs is fixed when it is written,
+    /// so a login stored while sync was off would stay on this device while its
     /// account record travelled — every other device showing an account whose
     /// credential never arrives.
+    ///
+    /// Deliberately not called when sync is switched off. Making a
+    /// synchronizable item local means deleting and rewriting it, and deleting
+    /// a synchronizable item propagates to every device (Apple-documented, and
+    /// measured for this project) — so "stop syncing this login" would sign the
+    /// user out on their other devices, which is not what the toggle says.
+    /// Turning sync off stops new writes from syncing and stops account records
+    /// from uploading; what is already in iCloud Keychain stays.
     private func resyncStoredLogins() {
         appEnvironment?.invidiousCredentialsManager.resyncCredentialsWithCurrentSetting()
         appEnvironment?.pipedCredentialsManager.resyncCredentialsWithCurrentSetting()