fix: BUG-009/010/011 — DataMasking, cancel button, SQL casts

BUG-009 (P1): Add frontend DataMasking in saas-relay-client.ts
- Masks ID cards, phones, emails, money, company names before relay
- Unmasks tokens in AI response so user sees original data
- Mirrors Rust DataMasking middleware patterns

BUG-010 (P3): Send button transforms to Stop during streaming
- Shows square icon when isStreaming, calls cancelStream()
- Normal arrow icon when idle, calls handleSend()

BUG-011 (P2): Add ::timestamptz casts for old TEXT timestamp columns
- account/handlers.rs: dashboard stats query
- telemetry/service.rs: reported_at comparisons
- workers/aggregate_usage.rs: usage aggregation query

crates/zclaw-saas/src/account/handlers.rs

@@ -193,9 +193,9 @@ pub async fn dashboard_stats(
         .and_utc();
     let today_row: DashboardTodayRow = sqlx::query_as(
         "SELECT
-            (SELECT COUNT(*) FROM relay_tasks WHERE created_at >= $1 AND created_at < $2) as tasks_today,
-            COALESCE((SELECT SUM(input_tokens) FROM usage_records WHERE created_at >= $1 AND created_at < $2), 0)::bigint as tokens_input,
-            COALESCE((SELECT SUM(output_tokens) FROM usage_records WHERE created_at >= $1 AND created_at < $2), 0)::bigint as tokens_output"
+            (SELECT COUNT(*) FROM relay_tasks WHERE created_at::timestamptz >= $1 AND created_at::timestamptz < $2) as tasks_today,
+            COALESCE((SELECT SUM(input_tokens) FROM usage_records WHERE created_at::timestamptz >= $1 AND created_at::timestamptz < $2), 0)::bigint as tokens_input,
+            COALESCE((SELECT SUM(output_tokens) FROM usage_records WHERE created_at::timestamptz >= $1 AND created_at::timestamptz < $2), 0)::bigint as tokens_output"
     ).bind(&today_start).bind(&tomorrow_start).fetch_one(&state.db).await?;
 
     Ok(Json(serde_json::json!({

crates/zclaw-saas/src/telemetry/service.rs

@@ -97,13 +97,13 @@ pub async fn get_model_stats(
     param_idx += 1;
 
     if let Some(ref from) = query.from {
-        where_clauses.push(format!("reported_at >= ${}", param_idx));
+        where_clauses.push(format!("reported_at::timestamptz >= ${}", param_idx));
         params.push(from.clone());
         param_idx += 1;
     }
 
     if let Some(ref to) = query.to {
-        where_clauses.push(format!("reported_at <= ${}", param_idx));
+        where_clauses.push(format!("reported_at::timestamptz <= ${}", param_idx));
         params.push(to.clone());
         param_idx += 1;
     }
@@ -247,7 +247,7 @@ pub async fn get_daily_stats(
         COUNT(DISTINCT device_id)::bigint as unique_devices
      FROM telemetry_reports
      WHERE account_id = $1
-       AND reported_at >= $2
+       AND reported_at::timestamptz >= $2
      GROUP BY reported_at::date
      ORDER BY day DESC";
 

crates/zclaw-saas/src/workers/aggregate_usage.rs

@@ -60,7 +60,7 @@ async fn aggregate_single_account(db: &PgPool, account_id: &str) -> SaasResult<(
                 COALESCE(SUM(output_tokens), 0)::bigint, \
                 COUNT(*) \
          FROM usage_records \
-         WHERE account_id = $1 AND created_at >= $2 AND status = 'success'"
+         WHERE account_id = $1 AND created_at::timestamptz >= $2 AND status = 'success'"
     )
     .bind(account_id)
     .bind(period_start)