Switch user: accounts signed in on a device, with an optional PIN

Everyone signed in on a device with "Keep me signed in" is listed under the user menu's Switch user and on the sign-in page ("Who's watching?"), to switch between without a password. The list is a cookie (Lax, so it survives Google's sign-in redirect) encrypted with the data protection keys: user ids, security stamps and last use, 14 days, at most 8. The sign-in cookie's OnSigningIn keeps it current on every sign-in (password, Google, switch, re-sign-in after a stamp change); an unkept sign-in leaves it. An entry whose stamp no longer matches asks for the password again.

Sign out takes the account off the device and offers the others; ?all=true clears it. An account can set a 4-8 digit PIN (hashed, set with the password; wrong PINs count toward lockout) that switching into it asks for. Admin's two-step check belongs to the session, so it's asked again after a switch. Migration SwitchPin. Docs, changelog, tests.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com