fix: BUG-009/010/011 — DataMasking, cancel button, SQL casts

BUG-009 (P1): Add frontend DataMasking in saas-relay-client.ts
- Masks ID cards, phones, emails, money, company names before relay
- Unmasks tokens in AI response so user sees original data
- Mirrors Rust DataMasking middleware patterns

BUG-010 (P3): Send button transforms to Stop during streaming
- Shows square icon when isStreaming, calls cancelStream()
- Normal arrow icon when idle, calls handleSend()

BUG-011 (P2): Add ::timestamptz casts for old TEXT timestamp columns
- account/handlers.rs: dashboard stats query
- telemetry/service.rs: reported_at comparisons
- workers/aggregate_usage.rs: usage aggregation query

crates/zclaw-saas/src/telemetry/service.rs

@@ -97,13 +97,13 @@ pub async fn get_model_stats(
     param_idx += 1;
 
     if let Some(ref from) = query.from {
-        where_clauses.push(format!("reported_at >= ${}", param_idx));
+        where_clauses.push(format!("reported_at::timestamptz >= ${}", param_idx));
         params.push(from.clone());
         param_idx += 1;
     }
 
     if let Some(ref to) = query.to {
-        where_clauses.push(format!("reported_at <= ${}", param_idx));
+        where_clauses.push(format!("reported_at::timestamptz <= ${}", param_idx));
         params.push(to.clone());
         param_idx += 1;
     }
@@ -247,7 +247,7 @@ pub async fn get_daily_stats(
         COUNT(DISTINCT device_id)::bigint as unique_devices
      FROM telemetry_reports
      WHERE account_id = $1
-       AND reported_at >= $2
+       AND reported_at::timestamptz >= $2
      GROUP BY reported_at::date
      ORDER BY day DESC";