fix: BUG-009/010/011 — DataMasking, cancel button, SQL casts

BUG-009 (P1): Add frontend DataMasking in saas-relay-client.ts
- Masks ID cards, phones, emails, money, company names before relay
- Unmasks tokens in AI response so user sees original data
- Mirrors Rust DataMasking middleware patterns

BUG-010 (P3): Send button transforms to Stop during streaming
- Shows square icon when isStreaming, calls cancelStream()
- Normal arrow icon when idle, calls handleSend()

BUG-011 (P2): Add ::timestamptz casts for old TEXT timestamp columns
- account/handlers.rs: dashboard stats query
- telemetry/service.rs: reported_at comparisons
- workers/aggregate_usage.rs: usage aggregation query

crates/zclaw-saas/src/workers/aggregate_usage.rs

@@ -60,7 +60,7 @@ async fn aggregate_single_account(db: &PgPool, account_id: &str) -> SaasResult<(
                 COALESCE(SUM(output_tokens), 0)::bigint, \
                 COUNT(*) \
          FROM usage_records \
-         WHERE account_id = $1 AND created_at >= $2 AND status = 'success'"
+         WHERE account_id = $1 AND created_at::timestamptz >= $2 AND status = 'success'"
     )
     .bind(account_id)
     .bind(period_start)