Don't destroy the session when the account lookup returns None

[czpython]

Why

resolve_session_account dropped the session whenever Account.get(account_id) returned None — added in ENG-703 (#15) as cleanup for a "deleted account":

account = Account.get(account_id)
if not account:
    await sessions.drop_session(token)   # ← permanent logout
    return

But nothing deletes accounts — there's no code path, and every account FK is ON DELETE RESTRICT, so an account with any login/run/usage can't be removed. The "account is gone" case the guard defends can't happen legitimately.

So the guard only ever fires on an anomaly — a transient/ambiguous lookup miss — and in exactly that case, destroying the session is the wrong response: it turns a momentary blip into a forced re-login. This bit prod (2026-07-20): a session's account lookup transiently returned None, the session was dropped, and the operator was logged out despite the account being perfectly present.

Change

Remove the drop. A None still 401s that one request (current_session_account raises), but the session survives — so a transient miss self-heals on the next request instead of forcing a re-login. New regression test asserts a missing-account lookup leaves the session key intact.

Verification

• ruff / ruff format / pyright clean.
• test_auth.py full suite green (12 passed), including the new test_missing_account_does_not_drop_the_session.
• Complements the existing test_redis_eviction_signs_out_but_keeps_credentials (real session-key loss → 401 is still correct; that path is untouched).

Related: the transient-None trigger itself (why Account.get returned None under a concurrent request burst) is a separate open thread that needs request-level logging to pin — this PR removes the destructive amplifier, not that root.