feat(auth): N3 — server-side multi-session account switch

Track every account that completes OAuth in a browser session (session 'account_ids',
~14-day cookie), so the user can switch between them without another Google round-trip.
New GET /api/me/accounts (switchable accounts, active flagged) and POST /api/me/switch
(guarded: target must be in the session list — proof it signed in here — and re-checked
against is_allowed in case the invite was revoked). Logout now signs out the active
account and falls back to the most recent remaining one, else clears the session. UI: the
account popover lists the other signed-in accounts (click to switch, reloads) plus an
'Add another account' action (-> /auth/login, which uses prompt=select_account).
Trilingual. Third step of Epic N.

backend/app/routes/me.py

@@ -1,14 +1,62 @@
-from fastapi import APIRouter, Depends
+from fastapi import APIRouter, Depends, HTTPException, Request
 from sqlalchemy import func, select
 from sqlalchemy.orm import Session
 
-from app.auth import current_user, has_read_scope, has_write_scope
+from app.auth import current_user, has_read_scope, has_write_scope, is_allowed
 from app.db import get_db
 from app.models import Invite, User
 
 router = APIRouter(prefix="/api/me", tags=["me"])
 
 
+@router.get("/accounts")
+def my_accounts(
+    request: Request,
+    user: User = Depends(current_user),
+    db: Session = Depends(get_db),
+) -> list[dict]:
+    """The accounts that have authenticated in this browser session (switchable without a
+    new Google sign-in). The active one is flagged."""
+    ids = request.session.get("account_ids") or [user.id]
+    rows = {u.id: u for u in db.query(User).filter(User.id.in_(ids)).all()}
+    out = []
+    for uid in ids:  # preserve recency order from the session
+        u = rows.get(uid)
+        if u is not None:
+            out.append(
+                {
+                    "id": u.id,
+                    "email": u.email,
+                    "display_name": u.display_name,
+                    "avatar_url": u.avatar_url,
+                    "active": u.id == user.id,
+                }
+            )
+    return out
+
+
+@router.post("/switch")
+def switch_account(
+    payload: dict,
+    request: Request,
+    user: User = Depends(current_user),
+    db: Session = Depends(get_db),
+) -> dict:
+    """Switch the active account to another one already authenticated in this browser. No
+    Google round-trip — but only accounts present in the session list (proof they signed in
+    here) are allowed, and access is re-checked in case the invite was revoked since."""
+    target = payload.get("user_id")
+    if target not in (request.session.get("account_ids") or []):
+        raise HTTPException(status_code=403, detail="Not an account you've signed into here.")
+    u = db.get(User, target)
+    if u is None:
+        raise HTTPException(status_code=404, detail="That account no longer exists.")
+    if not is_allowed(db, u.email):
+        raise HTTPException(status_code=403, detail="That account no longer has access.")
+    request.session["user_id"] = target
+    return {"ok": True, "user_id": target}
+
+
 @router.get("")
 def get_me(
     user: User = Depends(current_user), db: Session = Depends(get_db)