Allow SSH keys on multiple accounts

Update validation and duplicate checks to scope key uniqueness per
account, and clarify the console error message. Document cross-account
key assignment and authentication testing.

docs/user_administration_tests.md

@@ -48,10 +48,12 @@ Verify all of the following fail without changing the account generation or key
 
 - Unsupported RSA, certificate, or unknown key types.
 - Truncated/invalid Base64, mismatched outer and embedded types, trailing blob data, malformed Ed25519 lengths, and an invalid/off-curve ECDSA point.
-- Adding the same key again to the same account or assigning it to a different account.
+- Adding the same key again to the same account.
 - Adding a fourth key to an account that already has three.
 - Deleting an empty/out-of-range slot.
 
+Assign the same public key to a second account and confirm it is accepted, receives an independent slot, and authenticates as the username selected by the SSH client.
+
 Then exercise `user key delete <username> <index> --force` and `user key clear <username> --force`, reboot, and confirm the exact remaining fingerprints persist. Phase 8A stores these keys but does not yet accept SSH key login.
 
 ### 5. Legacy credential rotation boundary and reboot reconciliation