fix(auth): clear active tokens before iam.login redirect to prevent init() race on callback page

src/hooks/useAccountSessions.ts

@@ -158,7 +158,12 @@ export function useAccountSessions(): AccountSessionsState {
     }
 
     // No cached tokens — need full OIDC login for this account.
-    // prompt=login forces credential entry even if IAM has a session.
+    // Clear active tokens so iam.init() on the /callback page doesn't
+    // race and re-authenticate as the old user before handleCallback
+    // can exchange the code for the new user's tokens.
+    for (const key of IAM_TOKEN_KEYS) {
+      try { localStorage.removeItem(key) } catch { /* non-fatal */ }
+    }
     void iam.login({ loginHint: account.email, prompt: 'login' })
   }, [user])