Settings: say pages are encrypted

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/web/static/app.js

@@ -555,7 +555,7 @@ function settingsPage() {
         row('Ctrl K', 'Search pages, or make a new one'), row('c', 'New page'), row('n', 'Jot a quick note'),
         row('Ctrl E', 'Switch between editing and View'), row('/', 'In a page: commands. Anywhere else: search'),
         row('[[', 'In a page: link to another page'), row('Ctrl B, Ctrl I', 'Bold, italic'), row('Tab', 'In a list: indent'))),
-      card('Privacy', h('p', { class: 'dim' }, 'Pages are stored as plain markdown files on the machine running Mako, under a folder only you map to. They are not encrypted on disk, so anyone who can read that machine can read them.'))),
+      card('Privacy', h('p', { class: 'dim' }, 'Pages are encrypted on the machine running Mako, with a key made for you alone from the server\'s key and your Authentik account. A copy of the disk or a backup of the notes folder cannot be read without that key. Whoever runs the server can still read pages while it is running, and your download above is plain markdown.'))),
   };
 }