Send account requests to the account's own Stalwart

Two requests ignored the domain mapping from #238 and went to STALWART_URL:

- /api/account/* re-fetched the upstream session without upstreamFor(), so
  once the five-minute session cache expired, password, app-password and
  2FA calls for a mapped domain reached the default server.
- The locale lookup resolved Stalwart's apiUrl against the default server
  rather than the one that issued the session.

Both now use the session's own server, with a test pinning the second.

server/src/app.ts

@@ -459,7 +459,11 @@ export function createApp(basePath = config.basePath): Hono<Env> {
    */
   const accountCtx = async (c: Context<Env>) => {
     const session = c.get("session");
-    const upstream = await getUpstreamSession(session.id, session.authorization);
+    // The account's own server. Without it, the first fetch after the cached
+    // session expires goes to STALWART_URL -- which, for a domain mapped
+    // elsewhere, either refuses the password or knows a different account by
+    // the same name (#238).
+    const upstream = await getUpstreamSession(session.id, session.authorization, upstreamFor(session.username));
     return { authorization: session.authorization, session: upstream, username: session.username };
   };