Switch the signed-in session's current account

Session-only, but returns 422 {"error":"session_required"} for a non-session caller — deliberately NOT the 403 every other session-only route in this file uses, per issue #325's acceptance criteria. Re-validates account_id as a current, non-suspended membership for the caller (403 {"error":"forbidden"} on either failure), persists it as the user's new default, and moves the session's own current account — both under one per-session mutex, so two concurrent switches on the same token can't leave the session and the durable default disagreeing. A session token that vanishes (logout, expiry) between the start of the switch and the session update returns 401; the database write has already landed and is not undone.