Version 0.66.1

Five database statements now carry the account check themselves, instead of trusting the code that calls them.

Nothing was reachable and nothing leaked: every one of these had a check in front of it, and that was verified one call site at a time — what changed is where the check lives. An audit a year-quarter ago counted four queries that relied on the code calling them to have checked whose row it was; when that count was taken again this month it was fifteen, because the convention lived in people's heads and the modules written since had no way to learn it. Five of the fifteen could take the check into the statement, and did. The other ten cannot, because the same support-inbox rows are reached three different ways and one of them is an operator reading across accounts on purpose, so they are now written down with the reason each is correct, and a test walks the data-access layer and fails on anything new that is not.