Web tests: cover initial session discovery on the Cloud account page #565

Coverage gap

AccountApp has separate initial states for a pending session check, an anonymous visitor, a signed-in user and a failed session request. The routing test replaces this component with a stub, so it does not protect those transitions or the Cloud-specific login destination.

Add focused component coverage for initial session discovery on /cloud.

Verified behaviour

Checked main f92d1f9a3fb424cceb852d04a4b0d1d96d8ad379, macOS 26.5.2 arm64, Node 24.15.0, Vitest 5.0.0 / happy-dom. Three temporary probes used a deferred me() response and a lightweight mocked CloudAccountPanel:

• While the request was pending, the loading message appeared and the account panel did not mount.
• Resolving with null showed the login action, which called startLogin("/cloud") when activated.
• Resolving with a synthetic user mounted the account panel.
• Rejecting with a synthetic error displayed an alert and Reload, without the account panel. Activating Reload called the spied browser reload once.

All three outcome probes passed and were removed afterwards. These were mocked UI checks; no live session or OAuth flow was used. No production defect was found.

Starting points

• web/src/AccountApp.tsx.
• web/src/__tests__/AppRouting.test.tsx currently verifies routing with a mocked AccountApp.

#538 / PR #552 cover logout failure after sign-in. That PR's tests were checked; this task covers the initial session request. Extend its AccountApp test file if it lands first.

Acceptance criteria

• Use a deferred session request to verify the checking state before resolving it.
• Cover anonymous, signed-in and rejected outcomes, including whether the child account panel mounts.
• Assert that the anonymous login action requests /cloud, and that Reload on session failure invokes browser reload only after activation.
• Keep API, navigation and child-panel behaviour mocked so tests neither navigate away nor start billing/export requests.
• Run the affected web tests and npm run typecheck.

Keep production behaviour unchanged. Follow CONTRIBUTING.md, including DCO sign-off (git commit -s).