[AlxcBTW]

Follow-up hardening from the robustness audit.

• Sign-in saves go through one ordered writer and the temporary file is written under a lock, so a sign-out cannot be undone by an earlier save finishing late.
• Observation logs: credential-bearing headers are replaced by a placeholder, each title's file stops growing at 16 MiB, and at most 8 invitation dialogs wait at once.
• A session whose record of this device's endpoint keeps differing from what was pushed is pushed once per value instead of repeatedly.
• An endpoint named by two different accounts (or by this device) gets no tunnel peer instead of silently overwriting the other.
• A join that is answered after its game ended or was replaced leaves the session at once.

Each change has a regression test for the input that used to misbehave.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}