clean up auth, some storage improvements

apps/accounts/src/accounts.app.ts

@@ -32,15 +32,7 @@ import type { App } from './context'
  * the token is invalid, or the `sub` claim isn't an integer.
  */
 async function authedId(c: Context<App>): Promise<number | null> {
-	const authHeader = c.req.header('Authorization') ?? ''
-	if (!authHeader.toLowerCase().startsWith('bearer ')) return null
-
-	const token = authHeader.slice('Bearer '.length)
-	const accountId = await validateAndGetAccountId(token, await c.env.JWT_SECRET.get())
-	if (!accountId) return null
-
-	const id = Number.parseInt(accountId, 10)
-	return Number.isNaN(id) ? null : id
+	return validateAndGetAccountId(c.req.raw, await c.env.JWT_SECRET.get())
 }
 
 /** Results.Unauthorized() equivalent — 401 with empty body. */
@@ -49,7 +41,7 @@ function unauthorized(c: Context<App>) {
 }
 
 /** Username changes a fresh account starts with (until one has been consumed). */
-const DEFAULT_USERNAME_CHANGES = 5
+const DEFAULT_USERNAME_CHANGES = 1
 
 /**
  * Username-change result envelope: `{ success, error, value }`, always HTTP 200.