fix(import): restore favorite + pinned on import/backup restore

A pinned entry came back unpinned after export→import. Wider than pinned:
`favorite` was WRITTEN into the export/backup/sync containers but nothing
ever read it back — not parseEntriesFromJSON, not encryptImportEntry, not
the server INSERTs. So it was a write-only field, and a restore silently
dropped both flags. `pinned` wasn't in any container at all.

Wired the full round-trip:
- containers: export + auto-backup now carry `pinned` (favorite was there).
- parseEntriesFromJSON reads both back (absent → 0, e.g. foreign CSV).
- encryptImportEntry passes them through to the body.
- server create + bulk-import INSERTs write favorite/pinned
  (GetValue<Boolean>(..., False) → 0 default). PUT still ignores them, so a
  sync update can't clobber local flags.

Sync stays device-local as decided 2026-07-11: buildSyncSnapshot now OMITS
favorite explicitly (it was dead weight before; with the passthrough live,
leaving it in would have started propagating it). Commented so the intent
isn't re-broken.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

js/app.sync.js

@@ -252,7 +252,10 @@ async function buildSyncSnapshot() {
             password:       plain === '[ERROR]' ? '' : plain,
             folder:         e.folder || 'All',
             tags:           parseTags(e.tags),
-            favorite:       !!e.favorite,
+            // favorite / pinned deliberately OMITTED — device-local by design
+            // (decided 2026-07-11, like the avatar). encryptImportEntry passes
+            // through whatever the container holds, so leaving them out here
+            // is what keeps them from propagating. Adding them back = they sync.
             totp_secret:    plainTotp,
             kind:           e.kind || 'login',
             template:       e.template || '',