fix(settings): scrub raw user_id + dead emails + stale repo link; add Sign out

User's brief explicitly banned 'random strings of numbers and letters'.
Settings was leaking a 12-char user_id slice next to 'Current'. Removed.

- Identity card: Signed in / Email / Status (no raw user_id)
- COMMON_EMAILS: replaced 4 dead demo identities with the 3 seeded
  personas (CEO/HR/IT) so quick-switch matches what the login page
  already advertises
- Sign out button: clears the bearer + sessionStorage and returns to /
- About copy: refreshed; stale gitea repo link removed (the new canon
  is shad/canvas-frontend)

src/scenes/Settings.tsx

@@ -5,10 +5,9 @@ import { api } from "../lib/api";
 import { User, Refresh, Cog, Pulse, Layers, Check } from "../components/icons";
 
 const COMMON_EMAILS = [
-  "dev@flow-master.ai",
+  "ceo-head@flow-master.ai",
-  "procurement.operator@flowmaster.local",
+  "hr-head@flow-master.ai",
-  "finance.lead@flowmaster.local",
+  "it-head@flow-master.ai",
-  "ops.admin@flowmaster.local",
 ];
 
 export default function Settings() {
@@ -59,20 +58,16 @@ export default function Settings() {
           <h3 className="panel-h"><User size={12} /> Identity</h3>
           <div className="settings-id">
             <div className="i-field">
-              <span>Current</span>
+              <span>Signed in</span>
-              <span className="mono">{actor?.user_id?.slice(0, 12) ?? "—"}</span>
+              <span>{userDisplayName ?? userEmail.split("@")[0]}</span>
             </div>
             <div className="i-field">
               <span>Email</span>
               <span>{userEmail}</span>
             </div>
             <div className="i-field">
-              <span>Display name</span>
+              <span>Status</span>
-              <span>{userDisplayName ?? "—"}</span>
+              <span>{actor?.user_id ? "active session" : "no session"}</span>
-            </div>
-            <div className="i-field">
-              <span>Backend</span>
-              <span className="mono">{api.config.baseUrl || "(same-origin via /api)"}</span>
             </div>
           </div>
 
@@ -97,9 +92,19 @@ export default function Settings() {
               ))}
             </div>
           </div>
-          <button className="link-btn" style={{ marginTop: 10 }} onClick={clearToken}>
+          <div className="settings-row" style={{ marginTop: 12 }}>
-            <Refresh size={12} /> Clear bearer token
+            <button className="btn btn-secondary" onClick={() => {
+              api.clearToken();
+              sessionStorage.removeItem("fm.mc.token.v1");
+              pushToast("ok", "Signed out.");
+              window.location.href = "/";
+            }}>
+              Sign out
             </button>
+            <button className="link-btn" onClick={clearToken}>
+              <Refresh size={12} /> Reset session
+            </button>
+          </div>
         </section>
 
         <section className="studio-panel">
@@ -151,14 +156,10 @@ export default function Settings() {
         <section className="studio-panel">
           <h3 className="panel-h"><Layers size={12} /> About</h3>
           <p className="settings-text">
-            FlowMaster Mission Control. Live at{" "}
+            FlowMaster operator cockpit. Live at{" "}
             <a className="settings-link" href="https://canvas.flow-master.ai" target="_blank" rel="noreferrer">
               canvas.flow-master.ai
-            </a>. All actions hit the real EA2 backend — the live console shows every
+            </a>. Every action writes to EA2 — open the live console (above) to see the API trail.
-            fetch. Source:{" "}
-            <a className="settings-link" href="https://gitea.flow-master.ai/shad/flowmaster-mission-control-demo" target="_blank" rel="noreferrer">
-              gitea.flow-master.ai/shad/flowmaster-mission-control-demo
-            </a>.
           </p>
         </section>
       </div>