Per-service locale override: effective locale chain, PATCH /me validation ...

users.locale is now purely the per-service override chosen in settings;
the auth-derived default lives in users.profile.locale and is never
written back over the override by login or the webhook. PATCH /me
normalizes language tags (en-US -> en), accepts auto to clear, and
rejects unsupported locales with 422. UserRead gains locale_effective
(override -> profile -> en) which the web UI and the extension use as
their UI language. The validation error handler strips non-serializable
pydantic ctx.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Serve extension design resources from the server as a versioned pack ...

CSS (card + popup), field-detection keyword tables and UI config now ship as
extensions/pack/ with sha256 in pack.json and a monotonic version. The backend
serves pack.json unauthenticated (no-cache) and files versioned/immutable; a
background-worker sync validates schema, ext-version compatibility and hashes,
then stores the pack atomically in chrome.storage.local — content scripts and
the popup only read storage, never fetch, and fall back to the bundled
defaults. Publish tool auto-bumps on content change and writes pack.json last.
Firefox bundle inlines pack-shared.js; release 0.2.0.

E2E (15/15): adoption, live restyle without re-release, rollback and
min-extension guards, sha-mismatch abort, offline fallback. Tests: node 25+21,
pytest 57.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Add in-app extension download page ...

Distribute the gnexus-creds browser extension from the service itself.
Package Chrome and Firefox builds into extensions/dist/ with a manifest
describing version, checksums, and sizes; serve them via authenticated
FastAPI endpoints and surface a new Extension tab in the Vue UI with
download cards, SHA-256, and install instructions.

Co-Authored-By: Claude <noreply@anthropic.com>

Production-ready rewrite: UI kit integration, admin backups, sorting, profile editing, and security hardening ...

- Frontend: complete rewrite using gnexus-ui-kit components (GnNavigationShell,
  GnTable, GnTimeline, GnModal, GnToastProvider, GnSkeleton, etc.)
- Frontend: browser route sync (/secrets/:id, /audit/:id), pagination,
  real-time search debounce, skeleton loading states, retry with backoff
- Frontend: profile editing modal, token creation with scope selection,
  import/export, settings metrics, admin users table
- Backend: backup/restore endpoints for PostgreSQL and SQLite via pg_dump/psql
- Backend: admin backup CRUD, file download endpoint
- Backend: stats endpoint, PATCH /me profile endpoint, CORS middleware,
  graceful shutdown logging
- Backend: table sorting (sort_by/sort_dir) in list_secrets
- Backend: OAuth return_to validation, rate limiting on sensitive endpoints
- MCP: validation fixes, tool description improvements, protocol cleanup
- Tests: 44 passing including new backup test suite
- Docker: add postgresql-client, backups volume, deployment docs
- Docs: backup/restore instructions in deployment guide

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Implement initial gnexus-creds MVP scaffold