Refuse to repair a context that is not this identity's

Foreground activation repairs a selection whose account this device
knows was deleted. The check for whether that is safe was the identity
scope being resolved, which it already is in the window between an Apple
account change moving the namespace and the reload refilling memory —
so the repair weighed the previous identity's selection against the
previous identity's tombstones and announced the result to a user who
had not been shown an account yet. Fenced on the loaded namespace, the
same way saves are.

Three smaller things around the same theme:

- The destination rows forgot their membership answers on a credential
  or account change but not on an instance change, which adds a row to
  the picker while it is open. Unknown reads as unsubscribed, so that
  row offered to subscribe a channel the account already has.

- The subscriptions settings count applied whatever the fetch returned.
  A selection change is fenced by the service's provider generation, but
  the fallback to local is driven by availability and announces nothing,
  so the context is captured before the fetch and rechecked after it.

- Deleting a source from the browser runs the same cascade as deleting
  it from Settings, and was the one dialog left that did not say the
  logins go with it.

Yattee/Views/Components/SubscriptionDestinationMenu.swift

@@ -145,6 +145,14 @@ struct SubscriptionDestinationRows: View {
         .onReceive(NotificationCenter.default.publisher(for: .accountsDidChange)) { _ in
             invalidateMembership()
         }
+        // An instance switched on adds a row to `destinations` on the spot, and
+        // the round that would have asked about it has already run. Unknown
+        // reads as unsubscribed, so an account the channel is already on gets a
+        // checkmark-less row whose tap subscribes again instead of doing the
+        // unsubscribe it promises.
+        .onReceive(NotificationCenter.default.publisher(for: .instancesDidChange)) { _ in
+            invalidateMembership()
+        }
     }
 
     /// Forgets what is known and asks again.