Extended-auth account ids use an {account, Subtype} tag. These helpers let callers test account membership and extract the 32-byte pubkey without pattern-matching on specialize/1 results.