Your users already log in.
Now give them somewhere to save their data.

Help me add per-user cloud save to this app with jstash Apps. Each person who signs in gets their own private JSON documents and can read and write only their own. The app keeps the login it already has: the browser sends the signed-in person's login token, and jstash checks it. There's no server to write, no SDK to install, and no jstash API key in the page.

Before you write any code:
- Read the reference at https://jstash.app/docs/apps.md if you can fetch it. The essentials are below.
- Ask me for my jstash app ID. It starts with app_ and is part of the endpoint at the top of the app's page in the jstash dashboard: https://api.jstash.app/v1/apps/app_…/me. Never make one up. If I don't have an app yet, tell me to create one at https://app.jstash.app/apps (Apps → New app): pick the login, paste the one value it asks for, and add the app's website address; then, on the app's page, add any other addresses and turn on Allow localhost for local development.
- Ask me which login the app uses, unless the code already makes it clear. jstash works with Clerk, Supabase Auth, Firebase Auth and Sign In With Google only; GitHub sign-in works through Clerk, Supabase or Firebase. If the app uses something else, stop and tell me.

Then:
1. Look at the app: how sign-in is set up, and what each person's data is (settings, progress, drafts...). Tell me in a sentence or two what you'll save, under which document names.
2. Add one small module like the starter below, adapted to the app's framework and style. Call load once someone is signed in (null means nothing is saved yet, so use the app's defaults), and call save when the data changes (debounce rapid edits), never on a timer. Drop any pending save when the person signs out, switches account or deletes their account, so their data is never saved under someone else or after deletion. Don't change how sign-in works.
3. Get the login token right before each request; don't store it:
   - Clerk: Clerk.session.getToken() (in React, getToken from useAuth()). Use the default session token, not a JWT template. Tokens last 60 seconds; getToken() returns a fresh one when needed. Clerk tokens name the website they were made on, so every address where people sign in must be in the app's website addresses. Clerk development and production instances have different Frontend API URLs; each needs its own jstash app.
   - Supabase: (await supabase.auth.getSession()).data.session.access_token, using the app's existing client. data.session is null when nobody is signed in, so don't call jstash then.
   - Firebase: auth.currentUser.getIdToken(), using the app's existing getAuth() instance. currentUser is null until sign-in finishes, so wait for onAuthStateChanged.
   - Google: the ID token from the Sign In With Google callback (response.credential), kept in memory. It lasts one hour and can't be refreshed in the page, so on 401 AUTH_INVALID ask the person to sign in again.
4. If the app lets people delete their account, also call DELETE on the endpoint (https://api.jstash.app/v1/apps/{appId}/me) with their token as part of it.
5. Browsers are refused from any address that isn't listed under Website addresses on the app's page. Addresses match exactly (scheme, host and port), must use https, have no wildcards, and there can be up to 5; localhost works only with Allow localhost on. If an address the app runs on is missing, tell me exactly which one to add. Code can't change these settings.
6. Add a short jstash section to AGENTS.md (or CLAUDE.md, if that's what this repo uses): where the module is, that it sends the login token and never a jstash API key, and the reference link.
7. Tell me how to test it.

If you can't see or edit this project's files (for example, you're a chat assistant), ask me for the files you need, then give me complete code to paste and say where each piece goes.

Starter module (shown with Clerk; for another login, only token() changes):

```js
const JSTASH = 'https://api.jstash.app/v1/apps/APP_ID/me'; // APP_ID: the app ID I give you

function token() {
  if (!Clerk.session) throw new Error('Not signed in');
  return Clerk.session.getToken();
}

export async function save(name, value) {
  const res = await fetch(`${JSTASH}/${name}`, {
    method: 'PUT',
    headers: { Authorization: `Bearer ${await token()}` },
    body: JSON.stringify(value),
  });
  if (!res.ok) throw await failure(res);
}

export async function load(name) {
  const res = await fetch(`${JSTASH}/${name}`, {
    headers: { Authorization: `Bearer ${await token()}` },
  });
  if (res.ok) return res.json();
  const err = await failure(res);
  if (err.code === 'DOC_NOT_FOUND') return null; // nothing saved yet
  throw err;
}

// jstash errors are JSON: {"error": {"code", "message"}}
async function failure(res) {
  const { error } = await res.json()
    .catch(() => ({ error: { message: `jstash returned ${res.status}` } }));
  return Object.assign(new Error(error.message), { code: error.code });
}
```

## jstash Apps essentials
Every call sends Authorization: Bearer <the signed-in person's login token> and reaches only that person's documents. Never send a jstash API key here: it's refused, and it must never be in browser code.
GET    {endpoint}         List their documents: {"items": [{"name", "bytes", "version", "etag", "updated_at"}]}.
GET    {endpoint}/{name}  The document, raw, with an ETag header. 404 DOC_NOT_FOUND: nothing saved yet.
PUT    {endpoint}/{name}  Create (201) or replace (200) the whole document; the body is any JSON value.
DELETE {endpoint}/{name}  Delete it. 204, safe to repeat.
DELETE {endpoint}         Delete all of their documents.

Document names: 1-64 characters of letters, digits, - _ and ., not starting with a dot. Use a few fixed names like "settings" or "progress", never user input.
PUT replaces the whole document; there are no partial updates. If the same person might save from two devices at once, send the ETag from your last GET or PUT as If-Match. 412 ETAG_MISMATCH means it changed: load it again, reapply the change and retry.

Limits on Free (Pro in brackets): 200 documents per person, 100 KB each (1 MB). Per person: 100 saves a day (1,000) and 1,000 reads (5,000); 60 saves and 300 reads a minute. Per app: 500 saves a day (50,000) and 5,000 reads (50,000). Up to 100 people across all my jstash apps (1,000). Daily limits reset at 00:00 UTC.

Errors are JSON: {"error": {"code": "...", "message": "..."}, "request_id": "..."}. Branch on code, never on message. Log the message: it says what to fix, but it's written for developers, not for the people using the app.
- 400 INVALID_REQUEST: the document name isn't allowed. 400 INVALID_JSON: the body isn't JSON.
- 401 AUTH_REQUIRED, AUTH_INVALID: no token, or it's expired or not from the app's login.
- 403 FORBIDDEN: the website isn't one of the app's addresses (the message names it), anonymous sign-ins are refused, or the app is read-only.
- 403 APP_LIMIT_REACHED, STORAGE_LIMIT_REACHED: a plan limit. 404 APP_NOT_FOUND: wrong app ID.
- 403 APP_SUSPENDED: the app was taken offline; don't retry.
- 413 PAYLOAD_TOO_LARGE: the document is over the size limit.
- 429 RATE_LIMITED: wait a minute and retry. 429 WRITE_LIMIT_REACHED: a daily limit is used up; don't retry before 00:00 UTC.
- 500 INTERNAL_ERROR, 503 LOGIN_PROVIDER_UNAVAILABLE, R2_UNAVAILABLE, DATABASE_UNAVAILABLE: retry shortly.

jstash keeps no backups or old versions of documents. Don't store sensitive personal data such as health information.