feat: unified entry slideover + custom icons + UX fixes

Unified create/edit slideover
- openSlideOver(id) now accepts null for new entries. Same UI
  (icon, name, site, user, password, TOTP, folder, tags) for both
  create and edit. Drops the separate entry modal — no more "save
  first, then add TOTP" two-step.
- "+ New" button, Ctrl+K → New entry, and Ctrl+Shift+A all route
  through the slideover. Ctrl+Shift+A pre-fills the title with the
  foreground window's name.
- Save button visible from the start in new mode (no dirty wait).
- Title shows mode unambiguously: cyan "+ New entry" vs
  "Edit · <name>".

Custom icon upload (soIconField)
- 56×56 preview at the top of every slideover + Upload icon /
  Remove buttons. Same POST /entries/{id}/icon endpoint as the
  auto-fetch path. Validates type / size (64 KB cap matching server).
- Solves the case where DDG doesn't index a domain (self-hosted
  apps, private sites): the user pastes any image and it sticks.

Favicon: privacy-first, DDG only
- Removed the direct-fetch fallback steps (3-5). Privacy stance:
  zero DNS leak outside icons.duckduckgo.com. Domains DDG doesn't
  cover stay icon-less until the user uploads a custom one.
- PM.Favicon.FetchFaviconDataUri takes an optional TFaviconLog
  callback so UMainForm can stream per-step trace into LogLine for
  diagnostics.

Fixes
- Slideover z-index 30 → 50. The topbar's backdrop-filter creates a
  stacking context at z-index 40 which was clipping the slideover
  header (title + close button hidden behind topbar).
- RestoreFromTray no longer un-maximises a maximised window when
  called outside a tray-restore context (Ctrl+Shift+A, Ctrl+Shift+L
  picker, app/focus cmd). SW_RESTORE on a maximised window reverts
  to normal — now we only SW_RESTORE if IsIconic.
- "Show all"/"Show less" per-category state survives renderGrid
  re-renders (healthExpanded map).
- "+ New" and dashboard "Fix" buttons stopPropagation so the
  document-level click-outside handler doesn't close the slideover
  they just opened.
- soDirtyCheck keeps Save visible while in new mode regardless of
  diff.
- openSlideover → openSlideOver typo fix across all call sites.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

CLAUDE.md

@@ -166,9 +166,11 @@ Opt-in (`state.faviconsEnabled`, default OFF, synced via `settings_json`).
 La SEULE feature qui sort sur le réseau côté Delphi (HIBP est côté JS).
 
 - Source : `https://icons.duckduckgo.com/ip3/<host>.ico` — proxy DDG, pas
-  de tracking, retourne PNG 16-32 px. Centralisé → seul DDG voit la
-  liste des domaines stockés, vs hit chaque /favicon.ico (qui leakerait
-  TOUT le vault à chaque site)
+  de tracking, retourne PNG 16-32 px. **DDG-only par design** : pas de
+  fallback vers `/favicon.ico` direct (qui leakerait DNS à chaque
+  domaine stocké). 2 essais : host complet puis SLD (`chat.qwen.ai` →
+  `qwen.ai`). Pour les sites privés/self-hosted que DDG ne couvre pas,
+  l'user upload une icône custom via `soIconField` dans le slideover
 - `THTTPClient` (`System.Net.HttpClient`) qui wrappe **WinHTTP** sur
   Windows → TLS natif via le store de certificats Windows. Pas de
   DLLs OpenSSL à shipper (Indy aurait silencieusement fail sans