runs: scope by account; app: the PKCE half of signing in

Three phones on one account now produce one history, which is the main reason to
have accounts beyond upload permission. GET /v1/runs returns the account's runs
and says how many devices contributed; fetching and deleting resolve a run id
against the caller's own devices, so an id from another account is not found
rather than fetched from wherever it happens to live.

The rule that needed stating: the empty account is never a group. Devices nobody
has signed in on are unrelated devices that share the absence of an owner, and
matching on "" would let any anonymous device read every other one's runs.
Tested, along with sibling-device access working and cross-account access not.

App side: authorization code with PKCE. The app is a public client - anything
compiled into an APK can be read out with unzip and strings - and the redirect
returns through a custom URI scheme that any app on the device may register, so
an intercepted code is a real risk. PKCE makes a stolen code worthless: it can
only be exchanged by presenting a verifier that never left the process.

A callback whose state does not match is refused before the code is spent and
before any network call, since that is exactly how someone gets a victim to
complete the attacker's sign-in.

Nothing from the IdP is retained. The ID token is used once to prove who is
signing in and then discarded; the device credential authenticates everything
afterwards. No access tokens to store, no refresh tokens to rotate.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

server/internal/store/store.go

@@ -165,6 +165,26 @@ func (s *Store) LinkAccount(deviceID, accountID, displayName string) error {
 	return errors.New("no such device")
 }
 
+// DeviceIDsForAccount returns every device signed in to the same account.
+//
+// The empty account is never matched: devices that nobody has signed in on are not a group, they
+// are unrelated devices that happen to share the absence of an owner. Treating them as an account
+// would let any anonymous device read every other anonymous device's runs.
+func (s *Store) DeviceIDsForAccount(accountID string) []string {
+	if accountID == "" {
+		return nil
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	var out []string
+	for _, d := range s.data.Devices {
+		if d.AccountID == accountID {
+			out = append(out, d.ID)
+		}
+	}
+	return out
+}
+
 // Devices returns a copy of the device list, for the admin UI.
 func (s *Store) Devices() []Device {
 	s.mu.Lock()