Add a passphrase-locked vault

A second notebook whose pages are encrypted with a key made from a passphrase plus the server key. It is unlocked into memory only (15 minutes idle, Lock, or sign-out), is not in search, lists or downloads of the ordinary notebook, and limits wrong guesses.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/web/static/index.html

@@ -13,6 +13,7 @@
 <script src="toolkit.js"></script>
 <script src="markdown.js"></script>
 <script src="editor.js"></script>
+<script src="vault.js"></script>
 <script src="app.js"></script>
 </body>
 </html>