Add a passphrase-locked vault

A second notebook whose pages are encrypted with a key made from a passphrase plus the server key. It is unlocked into memory only (15 minutes idle, Lock, or sign-out), is not in search, lists or downloads of the ordinary notebook, and limits wrong guesses.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/web/auth.go

@@ -171,6 +171,7 @@ func firstOf(s ...string) string {
 }
 
 func (s *Server) logout(w http.ResponseWriter, r *http.Request, p principal) {
+	s.lockVault(w, r)
 	setCookie(w, s.cfg.Get(), sessionCookie, "", "/", 0)
 	writeJSON(w, map[string]bool{"ok": true})
 }