Add a passphrase-locked vault

A second notebook whose pages are encrypted with a key made from a passphrase plus the server key. It is unlocked into memory only (15 minutes idle, Lock, or sign-out), is not in search, lists or downloads of the ordinary notebook, and limits wrong guesses.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

README.md

@@ -33,6 +33,10 @@ Named for the mako shark, the fastest in the sea, because a notebook should keep
   keeps your text and retries. If your Authentik session ends mid-sentence, it keeps the text, offers
   to sign in again in another tab, and saves when you are back. If a page changed on another device,
   it asks which version to keep instead of overwriting.
+- **A vault for what needs more.** Pages in the Vault open only with a passphrase of their own, on top of
+  signing in. The server cannot read them until you unlock it, and they are in no list, search or download
+  of your ordinary notebook. It locks itself after 15 minutes idle, when you press Lock, and when you
+  sign out. See Encryption below.
 - **Take it with you.** Download everything as a zip that opens as a vault in Obsidian: file names are
   titles, so the links keep working, and journal days sit in a Journal folder.
 
@@ -139,6 +143,11 @@ markdown.
 - **What it protects:** a stolen disk or backup of `data/`, and anyone who can read the notes folder but
   not the settings. **What it does not:** someone who controls the running server, or who can read both
   `mako.json` and `data/`. Who you are in Authentik is not secret, so it cannot be the key by itself.
+- **The Vault** adds a second lock. Its pages are encrypted with a key made from your passphrase
+  (PBKDF2, 600,000 rounds) together with the server's key, so someone with the server's key still cannot
+  read them without the passphrase. The server holds the unlocked key in memory only, for as long as the
+  vault stays open. **There is no way to reset the passphrase**; forget it and those pages are gone.
+  Five wrong guesses in ten minutes lock out further tries for a while.
 - **Upgrading from 0.1.0:** existing plain files are read and saved again encrypted the first time
   that person signs in, and a `key` is added to your settings file.
 
@@ -191,6 +200,8 @@ file time as its date, and is then encrypted (name it with lower-case letters, n
 - Searching holds every page in memory, which is comfortable for tens of thousands of pages and not
   built for millions.
 - Pages are only reloaded from disk when Mako starts.
+- The Vault has its own pages only: no links into or out of it, no tags, no journal, and it is not in the
+  zip download. You cannot change its passphrase yet.
 - Live preview works a line at a time (a code block counts as one), so a table or a quote spread over
   several lines shows rendered line by line. View shows the whole page as one. Selecting across lines
   (Ctrl+A, Shift+Up or Down, Shift+click, or dragging) opens those whole lines as raw markdown, so a