Only a deletion the app can point at moves the selection

`correctIfContextRemoved` read a locally missing account as a deleted one
and reset the context with `setContext(.local)` — a new timestamp and a
pending upload. Now that foreground activation calls it, it ran before
the fetch that delivers the account record: a perfectly good remote
choice was reset and then published over everybody else's. It now asks
`AccountsManager` for a repair keyed on the deletion tombstone, which is
the same repair a deletion performs — a signed-in login on the same
server when there is one, the replaced choice's timestamp, nothing
uploaded. The toast names where the selection actually landed.

Adopting a synced context that named a deleted account repaired it but
kept whatever upload the previous choice still owed, so the sync engine
published the automatic fallback under that choice's timestamp — exactly
what not stamping it "now" exists to prevent. The adoption clears the
flag, and only on adoption: a local choice that outranks the repair keeps
its own upload.

The channel button's subscription lookup is fenced to the channel and the
round it was asked in, so an answer that lands after the user has walked
on — or after the account behind it changed — no longer writes itself
into the button on screen. Context and credential changes ask again. A
destination toggle is compared against the effective context rather than
the raw selection: the menu offers Local precisely when the selected
account cannot be written to, and that toggle has to be the one the
button then shows.

The destination rows forget their checkmarks when the logins change. The
answers describe credentials that have been replaced, and the tvOS picker
deliberately stays open across exactly that.

The subscriptions settings screen counts and exports what it is actually
reading from. The fetch behind both already followed the effective
context while the branch and the footer followed the selection, so an
unavailable account meant local data described as the server's.

The legacy `subscriptionAccount` migration refused to adopt a context
whose account had not synced yet and was never retried, leaving a fresh
install on local until the next launch. A synced account arriving now
retries it; the migration's own guards keep it a one-way move that never
overrides a choice made in the meantime.

The remaining negative-able Piped counts — likes, channel subscribers and
videos, playlist video counts — go through `PipedSentinel.count` like the
views and upload dates already did.

Yattee/Views/Components/SubscriptionDestinationMenu.swift

@@ -104,6 +104,18 @@ struct SubscriptionDestinationRows: View {
 
     @State private var membership = SubscriptionDestinationMembership()
     @State private var busy: Set<DataContext> = []
+    /// Bumped when the logins change, so the answers are asked for again.
+    @State private var membershipRound = 0
+
+    /// What a round of membership answers belongs to.
+    ///
+    /// The channel alone is not enough: the same channel on the same rows means
+    /// something different once a credential has been replaced, and the picker
+    /// deliberately stays open across such a change on tvOS.
+    private struct MembershipRequest: Equatable {
+        let channel: Channel.ID
+        let round: Int
+    }
 
     var body: some View {
         ForEach(destinations, id: \.self) { context in
@@ -121,9 +133,28 @@ struct SubscriptionDestinationRows: View {
         // Membership is only asked for once the rows are on screen: an unwarmed
         // provider answers by fetching that account's whole subscription list,
         // which is far too much to spend on a menu nobody opened.
-        .task(id: channel.id) {
+        .task(id: MembershipRequest(channel: channel.id, round: membershipRound)) {
             await loadMembership()
         }
+        // The credential behind an account was replaced, or the accounts
+        // themselves changed: every checkmark on screen describes the logins
+        // that were there before.
+        .onReceive(NotificationCenter.default.publisher(for: .accountCredentialDidChange)) { _ in
+            invalidateMembership()
+        }
+        .onReceive(NotificationCenter.default.publisher(for: .accountsDidChange)) { _ in
+            invalidateMembership()
+        }
+    }
+
+    /// Forgets what is known and asks again.
+    ///
+    /// Forgetting first, rather than waiting for the replacement answers: a row
+    /// toggled in between would otherwise toggle against the previous login's
+    /// membership and do the opposite of what its checkmark promises.
+    private func invalidateMembership() {
+        membership.invalidate()
+        membershipRound += 1
     }
 
     @ViewBuilder