feat: cookie-based auth, SSR dashboard, JS-optional login

apps/web/src/views/settings.ejs

@@ -84,14 +84,10 @@
 
   
   <script>
-    if (!requireAuth()) throw 'auth';
-
-    const key = localStorage.getItem('pingql_key');
-
     async function loadSettings() {
       const data = await api('/account/settings');
 
-      document.getElementById('primary-key').textContent = key;
+      document.getElementById('primary-key').textContent = data.account_id;
       document.getElementById('created-at').textContent = new Date(data.created_at).toLocaleDateString('en-US', { year: 'numeric', month: 'long', day: 'numeric' });
 
       if (data.has_email) {
@@ -155,7 +151,8 @@
     async function confirmReset() {
       if (!confirm('Rotate your primary key?\n\nYour current key will stop working immediately. Make sure to copy the new one.')) return;
       const data = await api('/account/reset-key', { method: 'POST', body: {} });
-      localStorage.setItem('pingql_key', data.key);
+      // Re-auth with new key (updates cookie)
+      await fetch('/account/login', { method: 'POST', credentials: 'same-origin', headers: {'Content-Type':'application/json'}, body: JSON.stringify({ key: data.key }) });
       document.getElementById('primary-key').textContent = data.key;
       location.reload();
     }