Fixes 'Make system active' in the web UI reporting a switch that never happened: switchSubscriptionAccount now passes adoptLive:false (same doctrine as the CLI switch in 2.1.9), so a dead vault credential surfaces as a re-login warning naming the live login instead of adopting the stranger and toasting success. Adds a setOAuthOverride test seam plus a regression test (fails pre-fix with a false switched:true, passes with the fix). Full suites green (651 tests), typecheck clean.