feat(tui): account settings — stats, password change, and logout

The settings popup opens with an Account block: who the session is logged in
as, how much it shares, the port peers reach it on, and the daemon it borrows
when the window is attached to one. Two rows follow, both confirmed before
they act. A password is typed twice, because the server sends no verdict on a
change and a typo entered once would leave the account with a password nobody
knows. Logging out closes the window and comes back to the login screen with
the stored password deleted, so the next start asks rather than walking
straight back in. A window attached to a daemon offers no logout: the login is
the daemon's.

"Change it on the server, then store it where the login lives" is one function
over the session and the secret store, so the window, the command and the
daemon share the rule rather than each spelling out its own idea of which
process owns the password.

Headless the same two acts are `account password` and `account logout`, and
the daemon answers `account.password` so a routed run is not a dead end —
`whoami` already reported who is logged in and what they share.

soulseek-rs/src/cli.rs

@@ -222,6 +222,10 @@ pub enum Commands {
     /// Confirm the credentials and connection work
     Whoami,
 
+    /// This account: its password, and what this machine stores for it
+    #[command(subcommand)]
+    Account(AccountCommand),
+
     /// The folders this client shares
     #[command(subcommand)]
     Shares(SharesCommand),
@@ -270,6 +274,34 @@ pub enum DaemonCommand {
     Stop,
 }
 
+#[derive(Subcommand, Debug)]
+#[non_exhaustive]
+pub enum AccountCommand {
+    /// Change the account's password on the server
+    Password(PasswordArgs),
+
+    /// Forget the password stored on this machine, so the next start asks
+    /// for it again
+    Logout,
+}
+
+#[derive(Args, Debug)]
+pub struct PasswordArgs {
+    /// The new password (visible in `ps`; prefer --new-password-stdin)
+    #[arg(
+        long,
+        value_name = "PASSWORD",
+        env = "SOULSEEK_NEW_PASSWORD",
+        hide_env_values = true
+    )]
+    pub new_password: Option<String>,
+
+    /// Read the new password from the first line of stdin (takes precedence
+    /// over --new-password)
+    #[arg(long, action = ArgAction::SetTrue)]
+    pub new_password_stdin: bool,
+}
+
 #[derive(Subcommand, Debug)]
 #[non_exhaustive]
 pub enum CompletionsCommand {