4fd5ba428e
API endpoints (all auth-gated to the logged-in user): - GET /api/me/storage — per-category disk breakdown - DELETE /api/me/originals — free originals/ dir (post-extraction cleanup) - DELETE /api/me/activities — wipe all activity data (password confirm) - DELETE /api/me — delete account + all data (password confirm) - PUT /api/me/display-name — update display name - PUT /api/me/password — change password (requires current password) Page at /settings/: - Storage card: activities / originals / Strava originals / photos / total with one-click 'Delete original files' when originals exist - Profile card: display name field with inline save - Password card: change password form - Danger zone: delete all activities or delete account (both require password confirmation in a modal before proceeding) Nav: 'Settings' link appears in the top bar after login (same as Admin).