Add a passphrase-locked vault

A second notebook whose pages are encrypted with a key made from a passphrase plus the server key. It is unlocked into memory only (15 minutes idle, Lock, or sign-out), is not in search, lists or downloads of the ordinary notebook, and limits wrong guesses.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/web/static/app.js

@@ -129,7 +129,8 @@ function updateNav() {
     tree(here),
     S.tags.length ? [h('div', { class: 'navsec' }, 'Tags'), S.tags.map(t => navItem('#/tag/' + encodeURIComponent(t.tag), 'tag/' + t.tag, t.tag, 'tag', t.count))] : null,
     h('div', { class: 'navsec' }, 'Other'),
-    navItem('#/trash', 'trash', 'Trash', 'trash', S.counts.trash || null));
+    navItem('#/trash', 'trash', 'Trash', 'trash', S.counts.trash || null),
+    navItem('#/vault', 'vault', 'Vault', 'lock'));
 }
 
 function buildShell() {
@@ -175,6 +176,7 @@ async function show() {
     case 'pinned': page = feed({ view: 'pinned', title: 'Pinned', desc: 'Notes you pinned to keep close.' }); break;
     case 'tag': page = feed({ view: 'all', tag: r.arg, title: '#' + r.arg, desc: 'Every page with this tag.' }); break;
     case 'trash': page = feed({ view: 'trash', title: 'Trash', desc: 'Deleted pages wait here until you empty the trash.' }); break;
+    case 'vault': page = vaultView(r.arg); break;
     case 'settings': page = settingsPage(); break;
     default: page = feed({ view: 'all', composer: true, title: 'Home', desc: 'Write anything down. Give it a title and a place later, or never.' });
   }