feat(cli): require dedicated host uid for accounts system units (#1873)

docs/plans/2026-11-10_accounts-design.md

@@ -1293,8 +1293,9 @@ Rollback keeps OIDC. Nothing in it removes `--sso` or turns sign-in off.
 
 - The supported rollback is a pinned code and config rollback: install the
   earlier stack copy with the same unit flags, including `--sso`, through
-  `webui-service.sh install --copy <earlier id>`, as the unit script
-  already describes. Leave accounts.json, its receipts and `.deployed` in
+  `stack-upgrade.sh rollback --instance NAME --to <earlier id>` for the
+  dedicated system units. The accounts instance must not use the
+  `webui-service.sh` user-unit path. Leave accounts.json, its receipts and `.deployed` in
   place. BASE code ignores them, and the next roll-forward needs them.
 - Before the first accounts org exists, that rollback restores today's
   behavior completely. `console.sso` owners sign in as before, and FED R6