Auth: a late link response can restore a signed-out or replaced session #76

From the Copilot review of #73 (#73 (comment)), on the account linking from #69 by @TomislavMladenov.

linkWithCredential compares the linked response only against the user captured before the HTTP request. If signOut() runs, or another account signs in while the link is pending, the response for the original user still passes the mismatch check and enqueueAuthPost installs that user again, undoing the sign-out or replacing the other account.

Suggested fix: check that the initiating session is still the active one before committing the linked user, with the check and the assignment serialised against session changes. This shares a root cause with the lookup-response issue filed alongside it.