p5: make the account menu reachable, and stop it calling the API signed out

Two defects, both found by running the thing rather than reading it.

The avatar was invisible in --preview-ui and I could not see why from the
code. A temporary log said it plainly: signedIn=true, then signedIn=false
a millisecond later. EnterPreviewUi revealed the avatar and the very next
auth push hid it again, so the ONE surface that is signed-in-only was the
one surface preview could not show — which is exactly what preview exists
for. ApplyAuthState already pins the home view with `showHome = loggedIn
|| previewUi_` and then passed raw `loggedIn` here; it now passes
`showHome`, and EnterPreviewUi stops poking at it. The identity itself
still comes from the jwt and is empty in preview, so nothing is
fabricated: the menu shows "Guest", Share and Sign out, and NOT "Create
account", because preview genuinely has no guest session.

The referral share guarded on apiReady(). That is api_.has_value(), set
at SDK INIT and true with no session at all — so the moment preview could
reach this menu, opening Share would have fired an unauthenticated
getNetworkReferralCode at the production API from whatever machine this
is. It guards on IsLoggedIn() now, which reads the stored client jwt.

Verified at the socket, not in the source: invoked Account then Share
URnetwork in --preview-ui and watched Get-NetTCPConnection for the pid.
Zero remote connections before or after, against 59 established
connections visible elsewhere on the box in the same instant — so the
measurement can see traffic, and there was none.

Also: the avatar button had no accessible name. Its content is an image,
so like the two terms checkboxes it did not appear in the UIA tree at
all — nothing announced the control that opens the account menu. It is
named for the destination it opens.

UIA confirms the open menu: MenuItem "Guest", MenuItem "Share
URnetwork", MenuItem "Sign out". The share's clipboard write and its
snackbar need a real session and are unverified.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PT7KcWCPKfFwQUc7SM3oZY

Author: Ryanmello07

app/src/App/AuthSheets.cpp

@@ -611,7 +611,12 @@ void ShowAccountMenu(FrameworkElement const& anchor, SdkHost& sdk,
   auto onShared = actions.onShared;
   auto queue = anchor.DispatcherQueue();
   share.Click([&sdk, onShared, queue](auto const&, auto const&) {
-    if (!sdk.apiReady()) return;
+    // IsLoggedIn(), NOT apiReady(). apiReady() is api_.has_value(), set at SDK
+    // INIT and true with no session at all, so guarding on it here would fire
+    // an unauthenticated getNetworkReferralCode at the production API from
+    // whatever machine this is — which is exactly what --preview-ui, now that
+    // it can reach this menu, would have done on every open.
+    if (!sdk.IsLoggedIn()) return;
     sdk.api().getNetworkReferralCode(
         [onShared, queue](std::optional<urnet::GetNetworkReferralCodeResult> result,
                           std::optional<std::string>) {

app/src/App/LoginPage.cpp

@@ -5,6 +5,7 @@
 
 #include <chrono>
 
+#include <winrt/Microsoft.UI.Xaml.Automation.h>
 #include <winrt/Windows.System.h>
 
 #include "MainWindow.xaml.h"
@@ -1137,6 +1138,10 @@ void LoginPage::ApplyAccountIdentity(std::string const& networkName, bool guest,
   // show and no action in the menu that would make sense.
   w_.AccountMenuButton().Visibility(signedIn ? Visibility::Visible : Visibility::Collapsed);
   if (!signedIn) return;
+  // The button's content is an avatar with no text, so like the terms
+  // checkboxes it had NO accessible name and did not appear in the UIA tree at
+  // all — it named the destination it opens, and nothing announced it.
+  Automation::AutomationProperties::SetName(w_.AccountMenuButton(), Loc("account"));
   // PersonPicture derives its initials from DisplayName; a guest has no
   // network name to derive from and gets the store's word for it.
   w_.AccountAvatar().DisplayName(networkName.empty() ? Loc("guest") : H(networkName));

app/src/App/MainWindow.xaml.cpp

@@ -393,8 +393,13 @@ void MainWindow::ApplyAuthState(urnw::AuthState state, std::string const& error)
     }
   }
   connect_->SetNetworkIdentity(networkName, guestMode);  // re-renders the status
-  // the title-bar avatar + its menu (iOS AccountMenu): same jwt, one more reader
-  login_->ApplyAccountIdentity(networkName, guestMode, pro, loggedIn);
+  // The title-bar avatar + its menu (iOS AccountMenu): same jwt, one more
+  // reader. `showHome`, NOT `loggedIn` — EnterPreviewUi used to reveal the
+  // avatar itself and the very next auth push hid it again, so the one surface
+  // that is signed-in-only was the one surface preview could not show. The
+  // identity stays whatever the jwt says (empty in preview); only the
+  // visibility follows the pinned view.
+  login_->ApplyAccountIdentity(networkName, guestMode, pro, showHome);
   if (loggedIn && !wasVisible) {
     // the drawer just appeared: refresh its state and play the entrance
     connect_->ResyncDrawer();