dashboard: a user's menu, with its credentials and logging out

The user's name, top right, opens a menu:

* "credentials…": the user's keys (GET /auth/keys), one added with its
  .pub line or removed but the last (/auth/keys/{id}); under a strict
  policy, how to sign them anew (continuum-signed key-add, key-remove);
  and where its password is: each node's --htpasswd, its operator's.
* "log out": this browser's session ends. Where the page got in by
  what it can't end (the browser's password, the proxy's), it is greyed
  (aria-disabled, not disabled, so a click still lands), its tooltip
  saying how to log out, and a click says so in a dialog.

The log out button and the text beside the name from 1165 go into it.
Checked in Chromium against stubbed endpoints: the menu, both log out
cases, the credentials dialog, no errors, nothing the content policy
refuses.

1 files changed, 6 insertions, 3 deletions

diff --git a/docs/dashboard.md b/docs/dashboard.md
index 027e094..9543be4 100644
--- a/docs/dashboard.md
+++ b/docs/dashboard.md
@@ -22,9 +22,12 @@ never asks for itself: no browser password prompt), or with a token: from `conti
 [`access.md`](access.md), Tokens), or any other. The page keeps a session for the
 browser, a cookie no script reads and no other site's page sends, renewed while the
 dashboard is open; it ends with the token's lifetime, or with "Log out of this
-browser" on the login page, or "log out" on the dashboard, which ends this browser's
-session only. Where the page got in by what it can't end, the browser's password or
-the proxy's, it says so beside the user's name. The page and the login page run their
+browser" on the login page, or "log out" in the user's menu on the dashboard (its
+name, top right), which ends this browser's session only. Where the page got in by
+what it can't end, the browser's password or the proxy's, "log out" is greyed, and
+says how instead. The menu's "credentials…" shows the user's keys, to add one (its
+`.pub` line) or remove one but the last; under a strict policy, how to sign them anew
+(`continuum-signed key-add`); and where its password is: in each node's `--htpasswd`. The page and the login page run their
 own script only (a content security policy naming it by its hash), and no other page
 may frame them. The API listens on localhost unless `--bind-addr` says otherwise;
 to look at a node on another machine, forward the port (`ssh -L 3000:localhost:3000