Secure account

Sign in once. Dashboard and extension stay connected.

Use local email/password for MVP testing, or configure Firebase and let users continue with Google. The extension still receives only a revocable extension-scoped session after pairing.