Auth: a late account lookup response is applied to whichever user is current #75

From the Copilot review of #73 (#73 (comment)), on the custom-token lookup from #71 by @KadirJeager.

updateByGetAccountInfo reads user when the lookup response arrives rather than the user whose ID token was sent. If user A's custom-token lookup is pending and user B signs in meanwhile, previous is B while responseUid returns A, and the copied session ends up with A's UID on B's ID and refresh tokens, persisted in that state.

The same read-at-response pattern predates #71 (master already did user = user?.copy(...) in the lookup and user = setResult(...) in sign-in), so this is a wider auth issue; the lookup is just where it now mixes identities.

Suggested fix: capture the initiating session when building the request and apply the response only if that session is still current, with the check and the assignment serialised against session changes (sign-out and sign-in).