fix(cli): retain ownership checks after Account expiry

[callumflack]

An expired Account login currently makes the CLI forget the saved account during Personal Server ownership checks. connect --no-input, scheduled collection and server sync can then upload to another account's server without asking.

Retain the saved address for ownership checks and server selection, while keeping token validity at the existing authorization boundary. Expired Account tokens remain rejected; a valid same-owner Personal Server session remains usable. collect --all now reports blocked pending uploads as sync_pending and exits 5 instead of reporting success. Explicit confirmation, env-token overrides and accountless collection retain their existing behavior.

Dependencies and merge order: independent PR against main. No dependency on #92 or any Unity Surfaces PR. No stacking or ordered merge required.

Verification

• Failing regressions committed before the fix: 8 failed, 7 passed on the original behavior.
• pnpm validate: 793 tests passed, with TypeScript, ESLint and formatting green.
• pnpm preflight:cli: completed with isolated demo homes, HTTP destinations blocked and real Chrome cookie import disabled; unrelated generated transcript drift excluded.
• Final focused ownership/auth/schedule tests: 256 passed.
• Built CLI against a fake local HTTP server: 14 cases passed. Expired A → B changed from exit 0 / 1 upload to exit 5 / 0 uploads. Same-owner sync and explicit foreign-write consent remain usable.
• Fresh structured autoreview: clean. Test review: pass.

The HTTP proof uses fake credentials and datasets. It does not claim hosted or real-provider verification. This PR does not change browser-profile policy, storage, flags, dependencies or packaging.

[callumflack]

Independent shipping verdict: PASS+NOTES

I did not author this PR. I built and exercised the actual CLI at parent and head against the same isolated fake HTTP server and connector, with throwaway VANA_HOME and fake credentials/data.

• Parent: 8 of 14 cases fail the intended contract. Expired A → B unattended connect, server sync, pending collection and scheduled collection return 0 and upload; a declined foreign sync also uploads. Current A → B pending-only collection incorrectly reports success despite skipping the upload.
• Head: all 14 cases pass. Unauthorized targets produce exit 5, zero uploads and zero connector starts. Same-owner sync/connect, env-token override, accountless collection, no pending work, and explicit confirmation remain usable; decline stops the write. Pending-only JSON explicitly reports sync_pending and zero synced datasets.
• Fresh focused ownership/auth/schedule checks: 256 tests pass. Both parent and head builds pass. No tracked files changed by this verification.

Verified head: ab166ec103c8e12e1ee4c3a867923557c80ee310
Verified base: f99bec8b235c2c5fdb2bd11875051fb0632f7bfb
Stable base-to-head patch-id: 5d5922be57c486db0425f397c32e2a042798c27c

Notes: Poteto shipping's independent parent/head procedure was adapted to a local Codex verifier because Cursor cloud agents are unavailable; gh was used because Origin is unavailable. This proves the built CLI ownership boundary and local HTTP/runtime effects. It does not claim real-provider, hosted Personal Server, production, or credential verification. Mergeability and required CI remain the landing agent's fresh checks.

[github-actions]

🎉 This PR is included in version 0.41.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀