docs: storage kinds in the canonical patterns, a password beside Google sign-in, performance mode is this device's

CLAUDE.md's per-account state row becomes the browser storage rule: a key
in storage.ts with its kind, a preference through usePref. The
self-hosting guide says to set a password even when signing in with
Google, so a broken Google client does not lock the account out.
Performance mode's hint says it applies on this device only.

docs/self-hosting.md

@@ -65,6 +65,11 @@ the server logs) can run setup. Then click through:
 
 That's it. You can change any of the optional settings later under the admin **Configuration** page.
 
+> **Set a password even if you sign in with Google** (Settings → Account → Password). If Google
+> sign-in stops working — the client secret rotated, the consent revoked, Google down — email and
+> password still let you in. An account that only ever used Google is otherwise locked out until an
+> admin creates a set-password link for it (Users).
+
 > The setup wizard only exists until you finish it. After that, the setup routes are disabled and
 > the token is invalidated — there's no setup surface left on a configured instance.