Settings › Account speaks the home page's language #9734

Settings › Account (profile, password, tokens, SSH keys) now draws as blocks and rows, with no cards or tables. I haven't measured the 50 ms warm response; the existing account timing tests still pass.

What changed (src/web/pages/account.ts)

• Every card() is now a .settings-block with an <h2>: Public profile, What you can do here, Phone notifications, open-platform.sh, the parent forge, Change password, Connect your harness, New token, New SSH key, Signed-in browsers.
• The unverified-email notice is a block with data-tone="attn".
• The tokens list is rows: name and scope badge, then created and last used, with Revoke at the end. An OAuth-issued token still names its client and says it renews itself.
• The SSH keys list is rows: name and algorithm, then fingerprint, added and last used, with Remove at the end.
• The signed-in browsers list is rows too, with Sign out at the end.
• An empty list is now one muted sentence instead of an empty() panel.
• Every form keeps its action and its same-origin check. The new-token secret still comes only through the one-shot flash.

Tests and docs

• test/account-rows.test.ts renders the four account pages and asserts there is no card and no <table. It also checks that tokens and keys are .setting-list rows under their headings with their delete links. All 3 tests fail on the old markup and pass now.
• test/tokens-oauth-client.test.ts: only its row-finder changed, from splitting on <tr> to splitting on <li, because the markup it searches changed. Its assertions are untouched.
• docs/design/areas/settings.md has a short Account section. No new component class.

Checks run

• bun x tsc --noEmit and bun scripts/design-lint.ts are clean.
• The account, tokens, keys, sign-in and connect-harness tests pass: 55 pass, 10 skipped, 1 failure that was my own test's setup, since fixed.

Not done

• The Passkeys page and the Everyday line live in other files and are untouched.
• I didn't run the full suite or load a preview page.

Try it: sign in and open /settings, /settings/tokens, /settings/keys and /settings/password.

Closes #9706

Settings › Account (profile, password, tokens, SSH keys) now draws as blocks and rows, with no cards or tables. I haven't measured the 50 ms warm response; the existing account timing tests still pass.

What changed (src/web/pages/account.ts)

• Every card() is now a .settings-block with an <h2>: Public profile, What you can do here, Phone notifications, open-platform.sh, the parent forge, Change password, Connect your harness, New token, New SSH key, Signed-in browsers.
• The unverified-email notice is a block with data-tone="attn".
• The tokens list is rows: name and scope badge, then created and last used, with Revoke at the end. An OAuth-issued token still names its client and says it renews itself.
• The SSH keys list is rows: name and algorithm, then fingerprint, added and last used, with Remove at the end.
• The signed-in browsers list is rows too, with Sign out at the end.
• An empty list is now one muted sentence instead of an empty() panel.
• Every form keeps its action and its same-origin check. The new-token secret still comes only through the one-shot flash.

Tests and docs

• test/account-rows.test.ts renders the four account pages and asserts there is no card and no <table. It also checks that tokens and keys are .setting-list rows under their headings with their delete links. All 3 tests fail on the old markup and pass now.
• test/tokens-oauth-client.test.ts: only its row-finder changed, from splitting on <tr> to splitting on <li, because the markup it searches changed. Its assertions are untouched.
• docs/design/areas/settings.md has a short Account section. No new component class.

Checks run

• bun x tsc --noEmit and bun scripts/design-lint.ts are clean.
• The account, tokens, keys, sign-in and connect-harness tests pass: 55 pass, 10 skipped, 1 failure that was my own test's setup, since fixed.

Not done

• The Passkeys page and the Everyday line live in other files and are untouched.
• I didn't run the full suite or load a preview page.

Try it: sign in and open /settings, /settings/tokens, /settings/keys and /settings/password.

Settings › Account now uses headings over rows, with no cards or tables. The check failed only because no commit had a "Try:" line. I added one in a new commit and pushed it. bun scripts/gate.ts passes locally, but I haven't seen the forge's check re-run on this push.

What changed (src/web/pages/account.ts)

• Every card on the profile, password, tokens and keys pages is now a block with an <h2>. Profile, password, notify, role, connect, and new token / new key all follow the same shape.
• Tokens, SSH keys and signed-in browsers are lists of rows. Each row has its name and badge, then dates and fingerprint, with Revoke, Remove or Sign out at the end.
• An empty list is one muted sentence.
• Every form keeps its action and its same-origin check. A new token's secret is still shown once only, through the one-shot flash.

Tests and docs

• test/account-rows.test.ts renders the four account pages. It asserts there is no card and no table, and that tokens and keys are list rows with their delete links. It fails on the old markup.
• test/tokens-oauth-client.test.ts: only its row-finder changed, from <tr> to <li. Its assertions are the same.
• docs/design/areas/settings.md has an Account section. No new component class.

Checks run: tsc and design-lint are clean, and the account, tokens, keys, sign-in and connect-harness tests pass. I did not run the full suite, and I did not measure the 50 ms warm response.

Not done: the Passkeys page and the Everyday line live in other files and are untouched.

Try: open /settings/tokens and /settings/keys on the preview. Tokens and keys are rows under headings, not cards or tables.

Both of sentinel's points are addressed and pushed to this branch. I couldn't take the 50 ms timings on the preview.

• Attention tone: I dropped data-tone="attn" from the unverified-email notice. It is now a plain .settings-block sentence, with the body indentation tidied and the stand-in-email check computed once. I didn't add a CSS rule, since that would need a new style in docs/design/areas/settings.md.
• Hand-rolled section: I kept the notice as its own section instead of using block(). block() always renders an <h2>, and this notice has no heading.
• Empty lists: test/account-rows.test.ts now covers all three.

- A fresh account's /settings/tokens and /settings/keys show the single muted sentence and no empty-title panel. - sessionsCard([]) shows its muted sentence and no <ul>. I called it directly because a signed-in page always lists the current browser.

• OAuth line: A new test inserts an OAuth client and token and asserts that data-oauth-client, the client name and "renews itself" sit inside that token's row.
• Checks: The new test file passes (5 tests), and tsc, gate.ts and design-lint are clean. I ran only that file, not the whole suite.
• Timings: Unauthenticated GETs of /settings, /settings/tokens and /settings/keys on the preview all returned 303 in 0.6–2.0 s. That is a sign-in redirect over the network, not a warm render of the page. The sandbox has no signed-in session on the preview, so I have no honest figure for the 50 ms bar or the JavaScript-off check. I'd rather say so than quote a redirect time.

Left #9706 open: 1 unticked item remain (bun scripts/design-lint.ts and the page tests pass; the page still answers in under 50 ms warm and works with JavaScript off.).