Fix suspicious-watch baseline snapshot to use the admin accounts API

fetch_account_counts() was hitting the public /api/v1/accounts/:id
endpoint, which 404s for any account that hasn't confirmed its email
yet. Most flagged signups haven't confirmed at the moment
account.created/approved fires, so the baseline snapshot silently
failed and the account never entered suspicious_watch -- 6 of 8
IP-flagged signups to date missed the sweep entirely. Switch to the
admin endpoint suspicious_sweep.py already uses successfully.

app/main.py

@@ -647,13 +647,24 @@ def maybe_start_suspicious_watch(account_id: str, acct: str) -> None:
 
 
 def fetch_account_counts(account_id: str) -> tuple[int, int]:
-    """Return (statuses_count, following_count) for an account via the public
+    """Return (statuses_count, following_count) for an account via the admin
     account API. Split out from maybe_start_suspicious_watch as a single seam
-    to stub in tests."""
+    to stub in tests.
-    resp = httpx.get(f"{MASTODON_BASE_URL}/api/v1/accounts/{account_id}", timeout=15.0)
+
+    Uses the *admin* endpoint (like suspicious_sweep._fetch_admin_account),
+    not the public one — the public accounts API 404s for any account that
+    hasn't confirmed its email yet, which most flagged signups haven't at the
+    moment account.created/approved fires, silently dropping them from the
+    watch list before the grace-period clock ever starts.
+    """
+    resp = httpx.get(
+        f"{MASTODON_BASE_URL}/api/v1/admin/accounts/{account_id}",
+        headers=_admin_headers(), timeout=15.0,
+    )
     resp.raise_for_status()
     data = resp.json()
-    return data.get("statuses_count", 0), data.get("following_count", 0)
+    account = data.get("account") or {}
+    return account.get("statuses_count", 0), account.get("following_count", 0)
 
 
 # --- Mastodon API (abuse) --------------------------------------------------