Replace the blob URL download JS with a Content-Disposition header on the export endpoint and a plain <a> tag. Consolidate restore JS from event listeners into a single global function.
Show cumulative cost, API call count, and total tokens in card layout when the user has AI usage data.
Add a Data section to the account page with buttons to download a JSON backup and restore from a previously exported backup file.
- Add /account page with passkey list, token list, and sign-out - Replace nav login/logout buttons with user icon linking to /account or /login - Add passkey management: add new passkeys (WebAuthn ceremony), delete with confirmation - Add token management: create, copy one-time value, revoke with confirmation - Add user/key/clipboard icon macros - Add PasskeyCredentialRepository::get() for ownership verification - Add WebAuthn passkey/start and passkey/finish endpoints for adding passkeys
