Add two-account session foundation

[CHOS1N11111]

Summary

• upgrade the encrypted credential vault to keep at most two accounts while decoding the existing single-account format
• serialize account activation, switching, and removal with write draining and rollback on persistence failures
• isolate session-sensitive caches and make logout/session-expiration target the expected account

Scope

This is the storage and session foundation only. The account switcher UI will be added separately.

Validation

• :core:data:testDebugUnitTest
• :app:testDebugUnitTest
• :app:assembleDebug
• :app:lintDebug