POC / DO NOT MERGE: feat(fxa-settings): add account switcher behind a feature flag

[vpomerleau]

Because

• Users with several accounts on one device can only reach one of them; switching means signing out first.
• localStorage already holds every signed-in account and a current-account pointer, so only the UI is missing.
• This is a proof of concept to gather feedback on the approach before a product decision.

This pull request

• Adds an AccountSwitcher chooser to the cached sign-in page and to the settings avatar menu.
• Ranks stored accounts: RP-requested email, then the browser's own account, then the current one, then recency.
• Only promotes an RP-requested email when that account is already current or the browser's, so a crafted ?email= cannot make another user's cached account the one-click default on a shared device.
• Signs in as the chosen account on selection, or routes to sign-in when no session is stored.
• Mirrors the browser's signed-in uid to localStorage so both surfaces can badge which account Firefox uses.
• Gates everything on a new accountSwitcherEnabled flag, off by default and on in local dev.

Issue that this pull request solves

Closes: N/A

Checklist

Put an x in the boxes that apply

• My commit is GPG signed.
• If applicable, I have modified or added tests which pass locally.
• I have added necessary documentation (if appropriate).
• I have verified that my changes render correctly in RTL (if appropriate).
• I have manually reviewed all AI generated code.

How to review (Optional)

• Key files/areas to focus on: lib/account-switcher/rank-accounts.ts, pages/Signin/components/SigninCached/index.tsx, components/Settings/DropDownAvatarMenu/index.tsx
• Suggested review order: ranking logic, then the sign-in chooser, then the avatar menu, then App/index.tsx uid mirroring
• Risky or complex parts: account selection and autoSignIn on SigninCached; setCurrentAccountUid is written before the target session is validated

Screenshots (Optional)

Other information (Optional)

Proof of concept, not for merge. No Jira ticket yet.

Security review run on this branch. Remaining low findings, left as-is for the POC:

• setCurrentAccountUid is set optimistically before the target session is confirmed valid.
• The no-session switch path navigates to /signin?email=…, putting an email address in the URL.