Harden account recovery and server ownership; simplify history review

[mayvqt]

Account setup and recovery now retain the original access deadline, preserve complete target policies, and keep incomplete-account cleanup durable across failures and shutdown. Changing or replacing a media server no longer sends old sessions or account work to the new server.

• Preserve target authentication defaults, reject ambiguous policy flags, and force invited accounts to remain non-administrators.
• Share guarded account recovery and durable cleanup across HTTP and maintenance, including interrupted password setup and lost completion acknowledgements.
• Bind invites, registrations, tracked users and sessions to provider, normalized URL and authenticated server identity. Publish immutable connection snapshots and verify each maintenance account operation.
• Add explicit server review for legacy/history records, merge duplicate tracking safely, and preserve original deadlines and invite tokens.
• Page invite/registration history, expose older work needing review, show expired links accurately, and replace the mobile navigation scroller with an accessible Menu control.

Upgrade: back up the complete state directory before schema revision 6. Sign in again and explicitly review legacy invites/accounts before automatic account work resumes. See docs/configuration.md and docs/development/operations.md. Rollback requires the pre-upgrade state and matching image.

Validation: affected Go race tests and vet passed, including revisions 1–5, repeat/rollback and encrypted-value preservation, cloned/replacement servers, session boundaries, lost acknowledgements and cleanup retries. Synthetic browser QA passed at 1440×1000 and 390×844 for setup/login, invite creation, account registration, server assignment, connection errors and keyboard/Menu navigation. No browser runtime errors or horizontal page overflow were observed. Local Go 1.27.1 is supplementary; CI uses the repository's specified toolchain. No live providers were changed.