fix: harden dashboard privacy, accuracy, and accessibility

[TheStreamCode]

Summary

Hardens the dashboard after the complete code, security, dependency, accessibility, packaging, repository, and public-presentation audit. The change removes persisted account snapshots and an unrelated API request, makes plan references verifiable, tightens the webview boundary, improves WCAG behavior, clears the current dependency advisories, and refreshes the GitHub-facing project presentation.

No linked issue.

Changes

• cache only the Plan Limits collapsed preference under schema version 3
• remove the /pricing API request and show account limits only for the current plan
• project an exact host-to-webview state shape and reject unknown message fields
• add truthful progress ARIA, live status announcements, semantic headings, visible PAYG warnings, and contrast-safe light-theme accents
• bound per-chute quota fallback calls to five concurrent requests
• update fast-uri and undici transitively through npm and pin CI to .nvmrc
• make the README opening more user-focused with direct installation and support links
• replace the obsolete dashboard screenshot with a current rendering from the compiled webview using synthetic values
• add a 1280×640 GitHub social-preview asset without including it in the VSIX

Verification

• npm run preflight passes
• Manually verified in Extension Development Host
• Usage/quota data renders correctly in Extension Development Host
• No new outbound endpoints beyond Chutes API
• npm ci succeeds with Node 22.17.0
• 83/83 tests pass; aggregate line coverage is 95.72%
• Full and runtime-only npm audits report zero vulnerabilities
• VSIX contains 32 expected runtime/user-facing files and no source, maps, tests, secrets, or GitHub-only social-preview asset
• Gitleaks reports no leaks
• README local links resolve and both presentation images were visually inspected

Privacy

The webview no longer persists usage windows, plan data, timestamps, errors, or PAYG credit through vscode.setState. Only the non-sensitive collapsed preference remains. The extension-host state stays in memory and API keys remain exclusively in VS Code SecretStorage.

The refreshed screenshot is rendered from the real compiled webview with synthetic values. It contains no API key, account identifier, live payload, or account history.

Notes

• The user-initiated pricing link uses the existing HTTPS-only chutes.ai allowlist; there is no new background network endpoint.
• A public welcome and support guide is available in Discussion #29.
• .github/social-preview.png is ready for the repository Social preview setting. Applying it remains an owner-side GitHub UI step because the connected Chrome session currently blocks local file uploads.
• Automated Windows UI control could not be used because its required runtime documentation interface was unavailable, so the F5/NVDA smoke-test items remain intentionally unchecked for reviewer verification.
• No version bump, tag, GitHub Release, Marketplace publish, or Open VSX publish is included.