feat(account-health): reconcile remote bind state and ignore stale runtime reports

Track an authRevision per local record so a fresh bind cancels in-flight
probes, sync server-confirmed health back into the desktop cache via
reconcileTrackedAccountRemoteState, include verified_at in the upsert
signature, and drop runtime health reports older than the stored
verified_at on the server side.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/tenant/app/desktop_account_service_test.go

@@ -117,3 +117,43 @@ func TestBuildDesktopAccountView_FallsBackToStoredClientWhenNoPresence(t *testin
 	}
 	assert.Equal(t, &lastSeen, view.ClientLastSeenAt)
 }
+
+func TestShouldApplyDesktopAccountRuntimeHealth_IgnoresReportOlderThanVerifiedAt(t *testing.T) {
+	verifiedAt := time.Date(2026, 4, 30, 9, 30, 0, 0, time.UTC)
+	reportCheckedAt := verifiedAt.Add(-time.Minute)
+
+	shouldApply := shouldApplyDesktopAccountRuntimeHealth(
+		DesktopAccountView{
+			ID:         uuid.NewString(),
+			Health:     "live",
+			VerifiedAt: &verifiedAt,
+		},
+		bufferedDesktopAccountHealthReport{
+			Health:    "expired",
+			AuthState: "expired",
+			CheckedAt: reportCheckedAt,
+		},
+	)
+
+	assert.False(t, shouldApply)
+}
+
+func TestShouldApplyDesktopAccountRuntimeHealth_AppliesReportAfterVerifiedAt(t *testing.T) {
+	verifiedAt := time.Date(2026, 4, 30, 9, 30, 0, 0, time.UTC)
+	reportCheckedAt := verifiedAt.Add(time.Minute)
+
+	shouldApply := shouldApplyDesktopAccountRuntimeHealth(
+		DesktopAccountView{
+			ID:         uuid.NewString(),
+			Health:     "live",
+			VerifiedAt: &verifiedAt,
+		},
+		bufferedDesktopAccountHealthReport{
+			Health:    "expired",
+			AuthState: "expired",
+			CheckedAt: reportCheckedAt,
+		},
+	)
+
+	assert.True(t, shouldApply)
+}