feat(tui): account settings — stats, password change, and logout

The settings popup opens with an Account block: who the session is logged in
as, how much it shares, the port peers reach it on, and the daemon it borrows
when the window is attached to one. Two rows follow, both confirmed before
they act. A password is typed twice, because the server sends no verdict on a
change and a typo entered once would leave the account with a password nobody
knows. Logging out closes the window and comes back to the login screen with
the stored password deleted, so the next start asks rather than walking
straight back in. A window attached to a daemon offers no logout: the login is
the daemon's.

"Change it on the server, then store it where the login lives" is one function
over the session and the secret store, so the window, the command and the
daemon share the rule rather than each spelling out its own idea of which
process owns the password.

Headless the same two acts are `account password` and `account logout`, and
the daemon answers `account.password` so a routed run is not a dead end —
`whoami` already reported who is logged in and what they share.

docs/daemon-protocol.md

@@ -148,6 +148,13 @@ file is its own; changing it does not reach a daemon. The exception is
 `shares.set`, which the CLI's `shares add`/`remove` call so a folder is served
 without waiting for a restart.
 
+**A password change belongs to the daemon's account.** `account.password`
+changes the password of the account the daemon is logged in as, and stores the
+new one on the daemon's host so the next start still logs in. The server sends
+no verdict on the change, so the `{"ok":true}` means the request went out. The
+password crosses the socket in plain text, exactly like the token: keep TCP
+behind an SSH tunnel.
+
 **Several clients, no locking.** Last write wins. Two clients cancelling the
 same transfer is two hands on one keyboard, not an error.