fix(stats): address review feedback on accessibility, races and edge cases

- Pin balance scrapes to the account that opened the driver: both the on-launch
  warmup refresh and the dashboard "Refresh balance" capture the account id +
  StatsManager up front and only persist if the active account is unchanged, so
  a mid-scrape account switch can't write one profile's balance into another's.
- Serialize ad-hoc balance refreshes through a dedicated lock held across the
  whole driver lifecycle, so concurrent refreshes can't open two drivers on the
  same Edge profile (the prior busy check was non-atomic).
- Accept a real balance of 0 in the scrape selector (was rejecting >= 0 as
  "not found"), so a brand-new account's zero balance is captured correctly.
- Make the stats card keyboard-activatable (Enter / Space) in addition to
  click, since it exposes role="button".
- Drop the quotes around the single-token Consolas font name in the dashboard
  diagnostic list to satisfy Stylelint.
- Add bottom padding inside the dashboard content container so the "All
  accounts" table isn't flush against the window edge.

Author: JeromeM

gui/dashboard.css

@@ -161,7 +161,7 @@ body {
 .diag-list {
   margin: 6px 0 0 0;
   padding-left: 18px;
-  font-family: "JetBrains Mono", "Consolas", monospace;
+  font-family: "JetBrains Mono", Consolas, monospace;
   font-size: 11px;
   line-height: 1.5;
 }

gui/dashboard.html

@@ -379,7 +379,8 @@ <h2 class="dash-title">
       setup_needed: 'Complete First Setup for this account first.',
       busy: 'Browser busy (a run or startup is using it) — try again in a moment.',
       not_found: "Couldn't read the balance from the rewards page.",
-      driver: 'Could not open the browser to read the balance.'
+      driver: 'Could not open the browser to read the balance.',
+      account_changed: 'Account changed during refresh — try again.'
     };
 
     function hide_diag() {

gui/index.html

@@ -114,7 +114,8 @@ <h1>AutoRewarder</h1>
 
     <!-- ==================== Stats card ==================== -->
     <section class="card stats-card" id="stats_card" role="button" tabindex="0"
-             title="Open the statistics dashboard" onclick="show_stats()">
+             title="Open the statistics dashboard" onclick="show_stats()"
+             onkeydown="if (event.key === 'Enter' || event.key === ' ') { event.preventDefault(); show_stats(); }">
       <div class="card-header">
         <div class="card-label">Stats</div>
         <span class="ghost-link" aria-hidden="true">

src/api.py

@@ -90,6 +90,9 @@ def __init__(self):
         self._driver = None
         self.is_driver_loading = False
         self._run_lock = threading.Lock()
+        # Serializes ad-hoc balance scrapes so concurrent refreshes can't open
+        # two drivers on the same Edge profile at once.
+        self._balance_lock = threading.Lock()
         # Set when the user clicks Stop. Long loops in search_engine and
         # daily_set poll this between iterations and bail out cleanly.
         self._stop_event = threading.Event()
@@ -1715,16 +1718,22 @@ def _refresh_balance_on_launch(self, driver):
         up-to-date total. Runs every launch (not just the first); a failed read
         silently keeps the previously stored balance.
         """
-        if self.stats is None or self.account_meta is None:
+        # Pin to the account that owns this warmup driver. The scrape runs on a
+        # background thread, so a mid-scrape account switch could otherwise save
+        # this profile's balance into another account's stats.json.
+        stats = self.stats
+        meta = self.account_meta
+        account_id = self.account_manager.current_id()
+        if stats is None or meta is None or account_id is None:
             return
-        if not self.account_meta.is_first_setup_done():
+        if not meta.is_first_setup_done():
             return
 
         # Only animate the card on the first launch, when there's nothing to
         # show yet. On later launches a value is already displayed, so refresh
         # it silently in the background — no distracting shimmer on a number
         # that's already there.
-        animate = self.stats.get_stats()["balance"]["current"] is None
+        animate = stats.get_stats()["balance"]["current"] is None
 
         self.log("Refreshing your Rewards points balance…")
         if animate:
@@ -1740,7 +1749,10 @@ def _refresh_balance_on_launch(self, driver):
                 "(keeping the last known total)."
             )
             return
-        self.stats.update_balance(balance)
+        # Skip if the user switched accounts while we were scraping.
+        if self.account_manager.current_id() != account_id:
+            return
+        stats.update_balance(balance)
         self._notify_stats_refresh()
 
     def refresh_balance(self):
@@ -1753,7 +1765,8 @@ def refresh_balance(self):
             dict: {"ok": True, "balance": int} on success, else
                   {"ok": False, "error": <reason>}.
         """
-        if self.account_manager.current_id() is None:
+        account_id = self.account_manager.current_id()
+        if account_id is None:
             return {"ok": False, "error": "no_account"}
         if self.account_meta is None or not self.account_meta.is_first_setup_done():
             return {"ok": False, "error": "setup_needed"}
@@ -1763,11 +1776,22 @@ def refresh_balance(self):
         if self._run_lock.locked() or self.is_driver_loading:
             return {"ok": False, "error": "busy"}
 
+        # Atomically claim the profile: the checks above are advisory, so a
+        # dedicated lock is what actually prevents two refreshes from opening a
+        # driver on the same Edge profile at once.
+        if not self._balance_lock.acquire(blocking=False):
+            return {"ok": False, "error": "busy"}
+
+        # Pin to the account that opened the driver so a concurrent account
+        # switch can't redirect this profile's balance to another account.
+        stats = self.stats
+        driver_manager = self.driver_manager
+
         self.log("Refreshing points balance…")
         self._set_stats_loading(True)
         driver = None
         try:
-            driver = self.driver_manager.setup_driver(headless=True)
+            driver = driver_manager.setup_driver(headless=True)
             balance = self._fetch_balance_with_driver(driver)
         except Exception as e:
             self.log(f"[WARNING] Balance refresh failed: {e}")
@@ -1779,6 +1803,7 @@ def refresh_balance(self):
                 except Exception:
                     pass
             self._set_stats_loading(False)
+            self._balance_lock.release()
 
         if balance is None:
             self.log("[INFO] Could not read the points balance from the rewards page.")
@@ -1792,7 +1817,10 @@ def refresh_balance(self):
                 "diag_error": info.get("error"),
             }
 
-        self.stats.update_balance(balance)
+        # Only persist + refresh the UI if we're still on the same account.
+        if stats is None or self.account_manager.current_id() != account_id:
+            return {"ok": False, "error": "account_changed"}
+        stats.update_balance(balance)
         self._notify_stats_refresh()
         self.log(f"Points balance updated: {balance:,}")
         return {"ok": True, "balance": balance}

src/stats/manager.py

@@ -80,7 +80,7 @@
       if (candidates.length < 14) {
         candidates.push(selectors[i] + ' => "' + (aria || txt).slice(0, 32) + '" [' + val + ']');
       }
-      if (val != null && val > 0) {
+      if (val != null && val >= 0) {
         return {
           value: val, via: selectors[i], candidates: candidates,
           url: location.href, title: document.title