Where settings live — tabs in /settings, no more /account split

Everything that used to live under /account now lives under /settings. The Settings page is a single sidebar with every administrative surface — profile, security, integrations, modules, Wally model, credentials, observability, usage — as a tab on the same shell. Old /account URLs redirect to the matching /settings tab automatically.

What changed:

• `/account` → `/settings` (still works as a redirect)
• `?section=...` (the older query param) → `?tab=...`
• Wally and Credentials, which used to be standalone pages, are now tabs in the Settings sidebar so admins find them in the same place as Integrations / Observability / Modules.

The Settings sidebar (admin / owner view):

• **Profile** — your photo, name, phone, display name.
• **Notifications** — what gets emailed to you, what stays in-app.
• **Security** — password, MFA, trusted devices, recovery, passkeys.
• **Modules** — turn modules on or off (and the Personal Modules section for /me).
• **Integrations** — Gmail, Cloudflare, GitHub, Stripe, Salesforce, HubSpot, NetSuite, Dynamics, Zoho, etc.
• **Wally** — the BYO model surface (Settings → Wally model). Members see a read-only view; owners/admins see the configuration cards.
• **Credentials** — long-lived API tokens for SDK / MCP / CI use. Tab includes revoke + audit log.
• **Observability** — outbound signed event stream destinations (Splunk / OTLP / Datadog / etc.). See the Observability article in Integrations.
• **Trust Score** — your org's current trust signals and recommended actions.
• **Usage** — pay-as-you-go totals for Wally, voice, storage, and any other metered services.
• **Compliance** — DPA download, AUP attestation, retention policy controls.
• **Billing** — invoices, current plan, Stripe Customer Portal.

What stays member-visible:

Members see only their own profile, notifications, and security tabs. Org-level tabs (Modules, Integrations, Wally, Credentials, Observability, Trust Score, Usage, Compliance, Billing) are owner/admin only — members get a friendly "ask your admin" view if they navigate there directly.

Why we collapsed it:

The /account vs /settings split was an artifact of an earlier era when "account" meant user-level and "settings" meant org-level. Today both routes need to expose user-level AND org-level surfaces depending on who's looking, so one shell with one sidebar is the cleaner mental model. The redirect keeps every old bookmark working.

If you have a link saved to /account:

It'll work. The redirect preserves the tab parameter too, so `/account?section=integrations` ends up at `/settings?tab=integrations` automatically.