fix(cc-config): one account is one profile, and rename it in place

Four defects, all from one design mistake: a profile's display name and its
filename were the same string.

- Saving the logged-in account made a SECOND profile of an account another
  profile already held. Both then reported themselves active, so there was
  nothing to switch between. `POST /profiles` now refuses `EDUPLICATE` and
  names the profile that already holds the account. Re-saving into the
  account's own profile stays allowed - that is the token-refresh path.
- Worse, an accidental duplicate could not be cleaned up: two profiles of one
  account are both active, and the delete guard refused any active profile, so
  neither was ever deletable. The guard now blocks only the LAST saved copy of
  the live account, which is the actual credential-loss condition it exists
  for. The trash button had to follow, or the server would allow what the UI
  hid.
- A name could not contain spaces or diacritics, because it had to be
  filename-safe. A profile now carries `name` (internal identifier, still the
  filename, still what every route takes) and `label` (what the user reads and
  edits: 1-60 free-form characters, control characters rejected, stored
  trimmed, unique case-insensitively). A label never touches a path, which is
  what makes "Tài khoản chính" a legal name.
- Naming happened up front in a "save current account as" field. That field is
  gone. The server derives the identifier, the save button lives on the live
  account's card and appears only while it is unsaved, and the label is edited
  by clicking it (Enter saves, Escape cancels).

Renaming rewrites the label in place and deliberately does NOT move `name`, so
it cannot half-fail and leave a profile unreachable. Profiles written before
labels existed report `label` equal to their `name`, so nothing needs migrating.

Adds `PATCH /api/cc-config/profiles`; `POST` now takes an optional `name`.

Verified: server 1431/1431 (11 new), client 459/459, tsc clean. Also exercised
end to end against a COPY of the real profile store on this machine: the
duplicate deleted, the last copy still refused, a Vietnamese label accepted,
and the stored access/refresh tokens and 0600 mode intact after a rename.

client/src/i18n/locales/en/ccConfig.json

@@ -222,12 +222,9 @@
     "warning": "Close your running Claude Code sessions before switching - a live session rewrites the config on exit and would put the old account back.",
     "activeLabel": "Logged in now",
     "noActive": "No Claude account is logged in on this machine.",
-    "unsavedActive": "This account is not saved as a profile yet - save it below, otherwise you cannot switch away without losing its credentials.",
-    "saveLabel": "Save the current account as a profile",
-    "namePlaceholder": "profile name (e.g. work)",
-    "saveButton": "Save",
-    "saveHint": "The dashboard cannot log in for you. To add another account: run `claude auth login` in a terminal, sign in, then come back and save it under a new name.",
-    "saveSuccess": "Saved the current account as profile \"{{name}}\".",
+    "unsavedActive": "This account is not saved as a profile yet - save it, otherwise you cannot switch away without losing its credentials.",
+    "saveButton": "Save this account as a profile",
+    "saveSuccess": "Saved the account you are logged in as. Click its name to rename it.",
     "empty": "No profiles saved yet - save the account you are logged in as to get started.",
     "activeBadge": "active",
     "switchButton": "Switch to",
@@ -236,7 +233,11 @@
     "deleteButton": "Delete profile",
     "deleteSuccess": "Deleted profile \"{{name}}\".",
     "savedAt": "Saved {{time}}",
-    "loginHint": "Add another account by logging in from a terminal first:"
+    "loginHint": "Add another account by logging in from a terminal first:",
+    "saving": "Saving…",
+    "renameLabel": "Profile name",
+    "renameHint": "Click to rename",
+    "renameSuccess": "Renamed to \"{{name}}\"."
   },
   "explain": {
     "hooks": {

client/src/i18n/locales/vi/ccConfig.json

@@ -217,12 +217,9 @@
     "warning": "Hãy đóng các phiên Claude Code đang chạy trước khi đổi - phiên đang chạy sẽ ghi lại config khi thoát và đưa tài khoản cũ quay về.",
     "activeLabel": "Đang đăng nhập",
     "noActive": "Chưa có tài khoản Claude nào đăng nhập trên máy này.",
-    "unsavedActive": "Tài khoản này chưa được lưu thành profile - hãy lưu bên dưới, nếu không sẽ không thể đổi sang profile khác mà không mất credentials của nó.",
-    "saveLabel": "Lưu tài khoản hiện tại thành profile",
-    "namePlaceholder": "tên profile (vd: work)",
-    "saveButton": "Lưu",
-    "saveHint": "Dashboard không thể đăng nhập thay bạn. Để thêm tài khoản khác: chạy `claude auth login` trong terminal, đăng nhập, rồi quay lại đây lưu với tên mới.",
-    "saveSuccess": "Đã lưu tài khoản hiện tại thành profile \"{{name}}\".",
+    "unsavedActive": "Tài khoản này chưa được lưu thành profile - hãy lưu lại, nếu không sẽ không thể đổi sang profile khác mà không mất credentials của nó.",
+    "saveButton": "Lưu tài khoản này thành profile",
+    "saveSuccess": "Đã lưu tài khoản đang đăng nhập. Bấm vào tên của nó để đổi tên.",
     "empty": "Chưa có profile nào - hãy lưu tài khoản đang đăng nhập để bắt đầu.",
     "activeBadge": "đang dùng",
     "switchButton": "Chuyển sang",
@@ -231,7 +228,11 @@
     "deleteButton": "Xoá profile",
     "deleteSuccess": "Đã xoá profile \"{{name}}\".",
     "savedAt": "Lưu lúc {{time}}",
-    "loginHint": "Thêm tài khoản khác bằng cách đăng nhập từ terminal trước:"
+    "loginHint": "Thêm tài khoản khác bằng cách đăng nhập từ terminal trước:",
+    "saving": "Đang lưu…",
+    "renameLabel": "Tên profile",
+    "renameHint": "Bấm để đổi tên",
+    "renameSuccess": "Đã đổi tên thành \"{{name}}\"."
   },
   "explain": {
     "hooks": {

client/src/lib/api.ts

@@ -1517,13 +1517,23 @@ export const api = {
     profiles: () =>
       request<{ items: CcProfile[]; active: CcAccountIdentity | null }>("/cc-config/profiles"),
     /**
-     * POST /api/cc-config/profiles - snapshot the logged-in account under
-     * `name`, overwriting a profile of that name.
+     * POST /api/cc-config/profiles - snapshot the logged-in account as a
+     * profile. The identifier and initial label are derived from the account;
+     * saving an account another profile already holds fails `EDUPLICATE`.
      */
-    saveProfile: (name: string) =>
-      request<{ ok: true; name: string } & CcAccountIdentity>("/cc-config/profiles", {
-        method: "POST",
-        body: JSON.stringify({ name }),
+    saveProfile: () =>
+      request<{ ok: true; name: string; label: string } & CcAccountIdentity>(
+        "/cc-config/profiles",
+        { method: "POST", body: JSON.stringify({}) }
+      ),
+    /**
+     * PATCH /api/cc-config/profiles - change a profile's display label. The
+     * `name` identifier does not move; spaces and diacritics are allowed.
+     */
+    renameProfile: (name: string, label: string) =>
+      request<{ ok: true; name: string; label: string }>("/cc-config/profiles", {
+        method: "PATCH",
+        body: JSON.stringify({ name, label }),
       }),
     /**
      * POST /api/cc-config/profiles/activate - make a saved profile the account
@@ -2310,7 +2320,10 @@ export interface CcAccountIdentity {
 
 /** One saved auth profile from GET /api/cc-config/profiles. */
 export interface CcProfile extends CcAccountIdentity {
+  /** Internal identifier (also its filename) — what the mutation routes take. */
   name: string;
+  /** Display name the user edits; falls back to `name` for older profiles. */
+  label: string;
   /** When the profile was last snapshotted, epoch ms. */
   savedAt: number | null;
   /** True when this profile's account is the one logged in right now. */

client/src/pages/CcConfig.tsx

@@ -4521,7 +4521,12 @@ function CommandSnippet({ command, label }: { command: string; label?: string })
 //
 // The dashboard cannot log a new account in (only `claude auth login` can mint
 // tokens), so adding a profile is always "log in, then snapshot what the CLI
-// wrote". Hence the save-current field rather than an add-account flow.
+// wrote" — hence a save button on the live account rather than an add-account
+// flow. There is no name field: the server derives the identifier, and the user
+// edits the display label in place by clicking it. That keeps the one string
+// the user types free of filename rules, so spaces and diacritics are fine.
+// The save button only appears while the live account is unsaved, because one
+// account is one profile — a second copy would just report itself active too.
 
 function ProfilesModal({ onClose, onToast }: { onClose: () => void; onToast: (t: Toast) => void }) {
   const { t } = useTranslation("ccConfig");
@@ -4529,7 +4534,9 @@ function ProfilesModal({ onClose, onToast }: { onClose: () => void; onToast: (t:
   const [active, setActive] = useState<CcAccountIdentity | null>(null);
   const [error, setError] = useState<string | null>(null);
   const [busy, setBusy] = useState<string | null>(null);
-  const [newName, setNewName] = useState("");
+  /** `name` of the profile whose label is being edited inline, plus its draft. */
+  const [renaming, setRenaming] = useState<string | null>(null);
+  const [draft, setDraft] = useState("");
 
   const load = useCallback(async () => {
     try {
@@ -4576,6 +4583,10 @@ function ProfilesModal({ onClose, onToast }: { onClose: () => void; onToast: (t:
 
   const activeSaved = items?.some((p) => p.active) ?? false;
 
+  /** How many saved profiles hold the same account as `p`. */
+  const copies = (p: CcProfile) =>
+    items?.filter((q) => q.accountUuid && q.accountUuid === p.accountUuid).length ?? 1;
+
   return (
     <div
       className="fixed inset-0 bg-black/60 z-40 flex items-center justify-center p-4"
@@ -4628,43 +4639,22 @@ function ProfilesModal({ onClose, onToast }: { onClose: () => void; onToast: (t:
               <div className="text-sm text-fg-muted">{t("profiles.noActive")}</div>
             )}
             {active && !activeSaved && (
-              <div className="text-[11px] text-status-warning pt-1">
-                {t("profiles.unsavedActive")}
+              <div className="pt-1.5 space-y-1.5">
+                <div className="text-[11px] text-status-warning">{t("profiles.unsavedActive")}</div>
+                <button
+                  disabled={busy !== null}
+                  onClick={() =>
+                    void run("save", () => api.ccConfig.saveProfile(), t("profiles.saveSuccess"))
+                  }
+                  className="h-7 text-[11px] font-medium px-2.5 rounded-md border border-accent/30 bg-accent/10 hover:bg-accent/20 text-accent inline-flex items-center gap-1.5 disabled:opacity-50"
+                >
+                  <Save className="w-3 h-3" />
+                  {busy === "save" ? t("profiles.saving") : t("profiles.saveButton")}
+                </button>
               </div>
             )}
           </div>
 
-          <div className="rounded-lg border border-border bg-surface-2 px-3 py-2.5">
-            <div className="text-[10px] uppercase tracking-wide text-fg-muted mb-1.5">
-              {t("profiles.saveLabel")}
-            </div>
-            <div className="flex items-center gap-2">
-              <input
-                value={newName}
-                onChange={(e) => setNewName(e.target.value)}
-                placeholder={t("profiles.namePlaceholder")}
-                className="h-7 flex-1 min-w-0 rounded-md border border-border bg-surface-1 px-2 text-xs text-fg-primary placeholder:text-fg-muted focus:outline-none focus:ring-1 focus:ring-accent/40"
-              />
-              <button
-                disabled={!newName.trim() || busy !== null}
-                onClick={() =>
-                  void run(
-                    "save",
-                    () => api.ccConfig.saveProfile(newName.trim()),
-                    t("profiles.saveSuccess", { name: newName.trim() })
-                  ).then(() => setNewName(""))
-                }
-                className="h-7 text-[11px] font-medium px-2.5 rounded-md border border-accent/30 bg-accent/10 hover:bg-accent/20 text-accent inline-flex items-center gap-1.5 disabled:opacity-50"
-              >
-                <Save className="w-3 h-3" />
-                {t("profiles.saveButton")}
-              </button>
-            </div>
-            <p className="text-[10px] text-fg-muted mt-1.5 leading-relaxed">
-              {t("profiles.saveHint")}
-            </p>
-          </div>
-
           {items === null && !error && <SkeletonRows n={3} />}
           {items !== null && items.length === 0 && (
             <div className="rounded-lg border border-dashed border-border bg-surface-2 px-4 py-8 text-center text-sm text-fg-muted">
@@ -4674,7 +4664,41 @@ function ProfilesModal({ onClose, onToast }: { onClose: () => void; onToast: (t:
           {items?.map((p) => (
             <div key={p.name} className="rounded-lg border border-border bg-surface-2 px-3 py-2.5">
               <div className="flex items-center gap-2 flex-wrap">
-                <span className="font-mono text-xs text-fg-primary">{p.name}</span>
+                {renaming === p.name ? (
+                  <input
+                    autoFocus
+                    value={draft}
+                    onChange={(e) => setDraft(e.target.value)}
+                    onBlur={() => setRenaming(null)}
+                    onKeyDown={(e) => {
+                      if (e.key === "Escape") setRenaming(null);
+                      if (e.key !== "Enter") return;
+                      const next = draft.trim();
+                      setRenaming(null);
+                      if (!next || next === p.label) return;
+                      void run(
+                        `rename:${p.name}`,
+                        () => api.ccConfig.renameProfile(p.name, next),
+                        t("profiles.renameSuccess", { name: next })
+                      );
+                    }}
+                    maxLength={60}
+                    aria-label={t("profiles.renameLabel")}
+                    className="h-7 w-48 rounded-md border border-accent/40 bg-surface-1 px-2 text-xs text-fg-primary focus:outline-none focus:ring-1 focus:ring-accent/40"
+                  />
+                ) : (
+                  <button
+                    onClick={() => {
+                      setDraft(p.label);
+                      setRenaming(p.name);
+                    }}
+                    title={t("profiles.renameHint")}
+                    className="text-xs font-medium text-fg-primary hover:text-accent inline-flex items-center gap-1 group"
+                  >
+                    {p.label}
+                    <Pencil className="w-3 h-3 opacity-0 group-hover:opacity-100 text-fg-muted" />
+                  </button>
+                )}
                 {p.active && (
                   <span className="text-[10px] px-1.5 py-0.5 rounded-full bg-status-success/10 border border-status-success/20 text-status-success">
                     {t("profiles.activeBadge")}
@@ -4690,7 +4714,7 @@ function ProfilesModal({ onClose, onToast }: { onClose: () => void; onToast: (t:
                       void run(
                         `switch:${p.name}`,
                         () => api.ccConfig.activateProfile(p.name),
-                        t("profiles.switchSuccess", { name: p.name })
+                        t("profiles.switchSuccess", { name: p.label })
                       )
                     }
                     className="h-7 text-[11px] font-medium px-2.5 rounded-md border border-accent/30 bg-accent/10 hover:bg-accent/20 text-accent disabled:opacity-50"
@@ -4700,14 +4724,17 @@ function ProfilesModal({ onClose, onToast }: { onClose: () => void; onToast: (t:
                       : t("profiles.switchButton")}
                   </button>
                 )}
-                {!p.active && (
+                {/* Deletable unless it is the ONLY saved copy of the live
+                    account — a redundant copy has to be removable, or an
+                    accidental duplicate could never be cleaned up. */}
+                {(!p.active || copies(p) > 1) && (
                   <button
                     disabled={busy !== null}
                     onClick={() =>
                       void run(
                         `del:${p.name}`,
                         () => api.ccConfig.deleteProfile(p.name),
-                        t("profiles.deleteSuccess", { name: p.name })
+                        t("profiles.deleteSuccess", { name: p.label })
                       )
                     }
                     title={t("profiles.deleteButton")}