refactor(forges): bind account-scoped adapter operations via getAccountAdapter

[afonsojramos]

Summary

• Split the forge adapter contract. ForgeAdapter keeps the forge-wide members (login flows, token validation, display helpers), and a new ForgeAccountAdapter carries the account-scoped operations with no account parameter.
• Adapters implement those operations under accountOps, still taking the account explicitly; the shape is derived from ForgeAccountAdapter by a mapped WithAccount type so the two cannot drift. getAccountAdapter(account) in the registry binds them, so call sites read getAccountAdapter(account).listNotifications() instead of getAdapter(account).listNotifications(account).
• Migrates all 18 call sites, re-points test spies at adapter.accountOps.*, and adds registry tests for the binding (argument forwarding, nested capability bundles, optional bundles, call-time member lookup).

Follows up on the double-passing pattern raised in #3255 (comment).

Notes

• No behaviour change: URLs, capability checks and notification flows are untouched. The full unit suite, typecheck, lint and format pass.
• A bound view closes over the account object it was created from, and the store replaces accounts on token rotation, so views should be created at the call site rather than stored. This is documented on ForgeAccountAdapter.
• followUrl<T> stays generic on the bound side; on the implementation side the type parameter erases to unknown, matching the trust boundary that existed before.

[afonsojramos]

What do you think of these ergonomics @setchy? I'm a bit on the fence with the naming. Chained, forAccount makes sense, but it isolation it is awful. getAccountAdapter is much cleaner, but it does use a lot more characters.

[setchy]

What do you think of these ergonomics @setchy? I'm a bit on the fence with the naming. Chained, forAccount makes sense, but it isolation it is awful. getAccountAdapter is much cleaner, but it does use a lot more characters.

let me soak on this PR for a moment 🧽

[afonsojramos]

@setchy just replaced the recursive binder and mapped types with explicit typed bindings. The account-bound API now stays the same, and followUrl preserves its generic contract throughout.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
95.6% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[setchy]

Let's give it a go.