feat: MFA tools, single-instance, tray polish, prefs persistence

Session highlights:

- feat(prefs): DPAPI-backed key/value store (PM.UserPrefs) — fixes
  rememberedUsername being lost across reboots due to the random
  ephemeral HTTP port changing the localStorage origin every launch.
  Bridge cmd://prefs/{get,set} round-trips through Delphi.

- feat(tray): icon visible from startup (NIM_ADD at constructor, not
  at first minimize). Tray context menu themed via uxtheme!135
  SetPreferredAppMode so it follows the app's dark/light setting.

- feat(single-instance): named mutex + RegisterWindowMessage broadcast.
  Second launch posts WM_PMSHOW to HWND_BROADCAST and exits; the
  running bridge restores the window from tray. Mutex lives in Local\
  namespace so distinct Windows users can still each run one.

- feat(mfa): Authenticator sidebar view (live TOTP codes for every
  entry with a secret) + standalone TOTP generator modal (paste
  base32 / otpauth:// URI, or generate a random 20-byte secret).

- feat(sidebar): Folders / Tags / Tools sections collapsible with
  chevron toggle. Badge counts stay visible when collapsed. State
  persisted in settings_json (synced across devices).

- feat(autofill): hotkey when vault is locked now restores the app
  and focuses the master password input instead of no-op'ing
  silently. Cleaner UX for the common "I hit Ctrl+Shift+L but the
  vault was locked" path.

- feat(quick-unlock): when enabled, skip lockVault on Windows lock /
  sleep. Rationale: the DPAPI blob already gates access via the
  Windows account, so re-locking on top of the OS lock is redundant.
  Idle auto-lock still fires (separate opt-in).

- fix(quick-unlock): re-sync state.quickUnlockEnabled from DPAPI
  source-of-truth at boot, instead of trusting (now-volatile)
  localStorage.

- docs: CLAUDE.md updated with all new modules, bridge commands,
  and the port-ephemeral pitfall.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

delphi-backend/Handlers/PM.Handler.Audit.pas

@@ -0,0 +1,65 @@
+unit PM.Handler.Audit;
+
+(*
+  POST /audit    body {action, site}   -> {ok:true}
+
+  Light-weight endpoint that lets the JS layer append an entry to audit_log
+  without going through the full entries pipeline. Used by the autofill
+  feature to record which site was filled (action = "autofill:<site>").
+  The bearer token identifies the user — no data beyond the action string
+  is stored.
+*)
+
+interface
+
+implementation
+
+uses
+  System.SysUtils, System.JSON,
+  IdCustomHTTPServer,
+  PM.Router, PM.JSON, PM.Session, PM.Audit;
+
+function GetClientIP(ARequest: TIdHTTPRequestInfo): string;
+begin
+  Result := ARequest.RemoteIP;
+  if Result = '' then Result := '127.0.0.1';
+end;
+
+procedure HandlePostAudit(ARequest: TIdHTTPRequestInfo;
+  AResponse: TIdHTTPResponseInfo; const AParams: TArray<string>);
+var
+  LUserId: Integer;
+  LBody: TJSONObject;
+  LAction, LSite: string;
+begin
+  LUserId := Authenticate(ARequest, AResponse);
+  RequireCSRF(ARequest, AResponse, LUserId);
+
+  LBody := TJSONHelper.ReadBody(ARequest);
+  try
+    LAction := LBody.GetValue<string>('action', '');
+    LSite   := LBody.GetValue<string>('site',   '');
+  finally
+    LBody.Free;
+  end;
+
+  if LAction = '' then
+  begin
+    TJSONHelper.SendError(AResponse, 400, 'action required');
+    Exit;
+  end;
+
+  // Keep the log compact: "autofill:github.com" rather than repeating
+  // structured columns we don't have in the current schema.
+  if LSite <> '' then
+    LAction := LAction + ':' + LSite;
+
+  LogAudit(LUserId, LAction, GetClientIP(ARequest));
+
+  TJSONHelper.SendOK(AResponse);
+end;
+
+initialization
+  Router.Register('POST', '/audit', HandlePostAudit);
+
+end.