[tim-smart]

Closes EFF-2517

Moves the account routes onto JanitorApi as the second group.

Domain

• Api/Account.ts has get, startLink, completeLink and unlink. completeLink declares AuthorizationExpired, AuthorizationRejected and AccountAlreadyConnected; unlink declares ConnectedAccountNotFound.
• The new GitHub/Authorization.ts holds AuthorizationExpired (410) and AuthorizationRejected (422), both without fields. The connections group reuses AuthorizationExpired later.
• Team/Account.ts gains ConnectedAccountNotFound (404, linkId) and AccountAlreadyConnected (409).

Cluster

• Ingress/Account.ts is now one HttpApiBuilder.group(JanitorApi, "account", …) layer, merged with the sync group in Routes.ts. It no longer sits in the raw route list.
• TeammateError is gone. Teammates fails with the domain errors directly:
  • The other-owner check and the unique-violation race in link both become AccountAlreadyConnected.
  • An unknown or used attempt becomes AuthorizationExpired.
  • A missing link becomes ConnectedAccountNotFound.
• AccountLinking maps LinkProofFailed to AuthorizationRejected.
• These now die: an unknown teammate, an unconfigured platform, GitHub failing to look up the user, and SQL or decode failures. admit can no longer fail, so the orDie in MembershipMiddleware is gone.
• Teammates.disconnect takes a LinkId, which the unlink path param decodes.

Web

• The account page calls api.account.*. completeLink and unlink map their tags to page copy with catchTags/catchTag, and orElseSucceed covers everything else. The page no longer uses lib/api.ts, which other pages still use.

Validation

The test changes are in e78d369, ahead of the implementation. At 3b88a20:

• nix develop -c pnpm exec vp check: 0 errors (322 existing warnings).
• nix develop -c pnpm exec vp test: 812 of 812 pass.

No test/Ingress/Account.test.ts was added. The handlers only forward to the services, and Teammates.test.ts and AccountLinking.test.ts already assert the new tags (EFF-2305 decision 8).