feat(notes): eye toggle to mask the note body in the editor

The note textarea showed its plaintext to anyone glancing at the screen,
unlike every other secret in the editor. An eye button on the NOTE label
masks it with -webkit-text-security (a textarea has no type="password").

The button IS the setting: it flips state.maskNotes, which is synced via
settings_json, so the choice sticks across entries and devices — no extra
Settings row for a one-bit preference.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

css/style.css

@@ -1891,6 +1891,10 @@ input[type="range"]::-webkit-slider-thumb {
     line-height: 1.55;
     white-space: pre-wrap;
 }
+/* A textarea has no type="password"; -webkit-text-security is the Chromium
+   equivalent (WebView2 is Chromium, so it's always available here). */
+.so-note-body.is-masked { -webkit-text-security: disc; }
+.so-note-label { display: flex; align-items: center; justify-content: space-between; }
 
 /* ---- + New dropdown ---------------------------------- */
 .new-entry-wrap {