Add a passphrase-locked vault

A second notebook whose pages are encrypted with a key made from a passphrase plus the server key. It is unlocked into memory only (15 minutes idle, Lock, or sign-out), is not in search, lists or downloads of the ordinary notebook, and limits wrong guesses.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/web/static/style.css

@@ -336,3 +336,14 @@
   textarea.live-edit { display:block; width:100%; min-height:1.7em; margin:0 0 0 calc(-1 * (var(--s2) + 2px)); padding:0 0 0 var(--s2); border:0; border-left:2px solid var(--accent); border-radius:0; background:var(--accent-soft); font-family:var(--font); font-size:var(--text-base); line-height:1.7; resize:none; overflow:hidden; }
   textarea.live-edit:focus { outline:none; border-color:var(--accent); }
   .live-tail { min-height:30vh; cursor:text; }
+
+  /* the vault */
+  .vault-gate { display:flex; justify-content:center; padding-top:var(--s6); }
+  .vault-gate .card { width:100%; max-width:420px; display:flex; flex-direction:column; gap:var(--s3); }
+  .vault-icon { align-self:center; color:var(--accent); }
+  .vault-form { display:flex; flex-direction:column; gap:var(--s3); }
+  .vault-list { list-style:none; margin:0; padding:var(--s1); }
+  .vault-row { display:flex; align-items:center; gap:var(--s3); padding:var(--s2) var(--s3); border-radius:var(--radius); flex-wrap:wrap; }
+  .vault-row:hover { background:var(--accent-soft); }
+  .vault-name { display:flex; align-items:center; gap:var(--s2); flex:1; min-width:0; color:var(--text); text-decoration:none; }
+  .clip1 { overflow:hidden; text-overflow:ellipsis; white-space:nowrap; }