Client commands tokens cover all your panel accounts

One token runs the commands of every account of its owner on the panel: /me
lists them, the plugin asks for the commands of each one signed in on the
device, and every request names its account by Telegram user id.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/how-it-works.md

@@ -30,17 +30,20 @@ A command reaches the handler in one of two ways:
 
 ## The client API
 
-`/api/v1/client/commands` is authenticated by a **commands** API token. Each token is bound to
-one user account of yours. A token is refused by the routes of the other kind of token.
+`/api/v1/client/commands` is authenticated by a **commands** API token. A token isn't bound
+to an account: it covers every user account of its owner (the accounts they added, or all for
+a superuser), and each request names the account by its Telegram user id. A token is refused
+by the routes of the other kind of token.
 
 | Route | Answer |
 |---|---|
-| `GET /me` | the bound account: `account_id`, `tg_id` (the Telegram user id the plugin matches), `account_name`, `running` |
-| `GET /` | `{commands: [{name, aliases, summary, description, reply, params: [{name, type, required, description, default, choices}]}], refresh_seconds}` |
+| `GET /me` | `{name, accounts: [{account_id, tg_id, name, running}]}`: the accounts the token covers |
+| `GET /?tg_id=…` | that account's `{commands: [{name, aliases, summary, description, reply, params: [{name, type, required, description, default, choices}]}], refresh_seconds}` |
 | `POST /execute` | body `{text, sender_id, chat_id, reply_to_message_id, topic_id, send}`; answer `{ok, error, html, text, entities, sent_message_id}` |
 
 `sender_id` is the Telegram user id of the account that typed the command. The panel refuses
-the command when it isn't the token's account, and handlers get it as `ctx.sender_id`.
+the command when it isn't one of the token owner's accounts, and handlers get it as
+`ctx.sender_id`.
 `chat_id` is the marked (Telethon) id, where channels are `-100…`. Entities use UTF-16
 offsets. Command errors come back as `ok: false` with a reason. HTTP errors mean the token
 was refused or the panel failed.
@@ -59,7 +62,8 @@ parse the same way. Keep the two in step: `tools/verify_bundle.py` and the panel
 
 ## The plugin side
 
-- **Catalog** (`catalog.py`): asks `/me` for each token, then that account's commands. It
+- **Catalog** (`catalog.py`): asks `/me` which accounts the token covers, then the commands
+  of each one signed in on the device. It
   asks again after `refresh_seconds` (an hour), or after 5 minutes when the request failed.
   Commands are cached in `files/client_commands/catalog.json`. A plugin's commands are added
   for every account, unless a panel command has the same name.