Harden session-cookie recovery after failed account switch

## Summary

Harden session-cookie recovery after a direct Firebase account switch when the new account's `POST /auth/session` request fails.

`createSession()` in `src/platform/auth/session/useSessionCookie.ts` is intentionally best-effort and currently logs failures. If account B's session creation fails while account A's HttpOnly session cookie remains in the browser, cookie-only endpoints can continue to receive account A's cookie until a later successful session refresh. Client code cannot directly clear an HttpOnly cookie.

## Required changes

Define and implement a deliberate resilience policy for this case. The solution should use a bounded retry and/or surface an actionable failure state, rather than silently relying only on `console.warn`.

Evaluate whether the server should explicitly prefer a valid current-account Bearer credential over a stale session cookie for affected authenticated endpoints, since a successful account-B session POST or server-side Bearer precedence is required to close the stale-cookie window.

## Affected areas

- `src/platform/auth/session/useSessionCookie.ts`
- Session-dependent, cookie-only authenticated request paths
- Server session/authentication precedence, if applicable
- Unit and browser coverage for direct Firebase account switching

## Acceptance criteria

- A failed account-B session-cookie creation after an A → B switch is retried a bounded number of times or produces a user-visible/actionable error state.
- Failures do not silently leave cookie-only authenticated operations using account A's session indefinitely.
- The selected policy is documented in code and covered by tests.
- Regression coverage verifies behavior when `POST /auth/session` fails during an account switch, including the eventual success or surfaced failure outcome.
- If Bearer-over-cookie precedence is used, coverage verifies that a valid account-B Bearer cannot be overridden by account A's stale cookie.

## Context

This is deliberately out of scope for the focused account-switch isolation fix and should be completed in a follow-up PR.

- PR: https://github.com/Comfy-Org/ComfyUI_frontend/pull/13832
- Review discussion: https://github.com/Comfy-Org/ComfyUI_frontend/pull/13832#discussion_r3626045904
- Requested by: @christian-byrne