Add cross-reference map, admin health page, passkeys and device list, settings tabs

- Reader: chapter cross-reference map (M) from IQ Bible's reference graph
- Admin: Health tab with disk use, snapshots (back up, download, restore), failure logs
- Passkey sign-in (WebAuthn), signed-in device list, sign out others, optional sign-in alerts
- Settings split into Account, Preferences, Notifications, Security, Your data tabs
- ntfy server field: catch a topic typed into the server box

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

src/syncService.js

@@ -179,6 +179,19 @@ export async function loginUser(email, password) {
   return request('POST', '/auth/login', { email, password });
 }
 
+// Passkeys and signed-in devices
+export const passkeySignInOptions = () => request('POST', '/auth/passkey/options');
+export const passkeySignInVerify = (response) => request('POST', '/auth/passkey/verify', response);
+export const listPasskeys = () => request('GET', '/passkeys');
+export const passkeyAddOptions = () => request('POST', '/passkeys/options');
+export const passkeyAdd = (response, name) => request('POST', '/passkeys', { response, name });
+export const passkeyRename = (id, name) => request('PATCH', `/passkeys/${encodeURIComponent(id)}`, { name });
+export const passkeyRemove = (id) => request('DELETE', `/passkeys/${encodeURIComponent(id)}`);
+export const listDevices = () => request('GET', '/sessions');
+export const signOutDevice = (id) => request('DELETE', `/sessions/${id}`);
+export const signOutOtherDevices = () => request('POST', '/sessions/sign-out-others');
+export const setLoginAlerts = (enabled) => request('PUT', '/auth/login-alerts', { enabled });
+
 /** Asks for a password-reset code to be sent to the account's notification topic. */
 export async function requestPasswordReset(email) {
   return request('POST', '/auth/forgot', { email });
@@ -275,6 +288,11 @@ export async function adminListUsers() {
   return request('GET', '/admin/users');
 }
 
+export const adminGetHealth = () => request('GET', '/admin/health');
+export const adminBackupNow = () => request('POST', '/admin/backups');
+export const adminRestoreSnapshot = (name) => request('POST', `/admin/backups/${encodeURIComponent(name)}/restore`, { confirm: name });
+export const adminSnapshotUrl = (name) => `${BASE}/admin/backups/${encodeURIComponent(name)}`;
+
 export async function adminDeleteUser(id) {
   return request('DELETE', `/admin/users/${id}`);
 }