1.0.5: Return the panel's word for which account a call is about

A plugin's API key is an admin key, because a client-panel page is drawn for
whichever account is looking. Left at that, a plugin could name any account on
the server in X-Hosting-Account, which is not what the approval screen offered
when it said "for the account viewing the plugin".

So the panel no longer lets a plugin choose. It puts a signed grant naming the
account in the envelope it sends, and the client API acts only on what that
grant says. This returns it. clientFor() is the only thing a plugin needs to
know about: it already scoped a call to the account a request concerns, and it
now carries the grant along with the username, because the two are the same
fact and a plugin should not be able to send one without the other.

forAccount() takes the grant as a second argument and sends it when there is
one. Nothing is invented when there is not: a plugin naming an account by hand
is the case the panel refuses, and making that call look authorised here would
only move the refusal further from the mistake.

Hook deliveries read the grant from the same place in their context, ready for
the panel to start sending it. A plugin acting on a hook that carries none is
refused, exactly as a page would be.

Needs the matching panel release: a panel without it ignores the header, and a
panel with it refuses a plugin that does not send one.