feat: Delphi backend + JS↔Delphi bridge (clipboard, tray, auto-lock)

Introduces the Delphi 12 FMX backend (PMServer) that hosts the embedded
WebView2 vault on 127.0.0.1, and a native bridge between JS and Delphi
that wires three privacy-focused features:

1. Secure clipboard
   Copying a password registers the Win32 "ExcludeClipboardContentFromMonitorProcessing"
   format alongside CF_UNICODETEXT, so Win+V clipboard history never sees
   the value. Auto-clears after 30s via TTimer. Bridge.copySecure() in
   app.js routes all password/username/secret copy paths through the
   native layer when running inside the Delphi WebView2 (falls back to
   navigator.clipboard for the PHP standalone).

2. Tray icon (X-to-tray when server running)
   Closing the dev panel hides both the form HWND and the TFMAppClass
   per-process proxy window that owns the FMX taskbar entry — the form's
   HWND alone is not the taskbar-visible one in FMX (took some iteration
   to discover). Tray menu: Open, Lock vault, Quit. Clipboard is force-
   cleared on minimize as extra safety. First-time minimize fires a
   balloon notification so the user knows the app is still running.

3. Auto-lock on Windows session lock (Win+L)
   wtsapi32.dll!WTSRegisterSessionNotification on a dedicated message-only
   window. On WM_WTSSESSION_CHANGE / WTS_SESSION_LOCK, the bridge calls
   ExecuteJavaScript('lockVault()'). Same path used by the tray "Lock vault"
   menu item.

Bridge architecture:
 - JS → Delphi via cmd:// URLs intercepted in OnBeforeNavigate
   (pattern lifted from DeskInsight Monaco). Currently exposes
   cmd://clipboard/copy?text=...&clear=... and cmd://clipboard/clear.
 - Delphi → JS via TTMSFNCWebBrowser.ExecuteJavaScript with guarded
   calls (typeof check) so the bridge degrades cleanly if app.js isn't
   loaded yet.

Files:
 - Source/PM.Bridge.pas (new) — TSecureClipboard + TPMBridge
 - UMainForm.pas/.fmx — bridge wiring, FormCloseQuery intercept, tray
   callbacks (BridgeTrayRestore / BridgeLockRequest / BridgeQuit)
 - js/app.js — Bridge object, 5 navigator.clipboard sites migrated to
   Bridge.copySecure with PHP-compatible fallback, Bridge.onTrayRestore
   handler that resets the auto-lock timer

.gitignore extended with Delphi build artifacts (*.dcu, Win32/, Win64/,
__history/, __recovery/, *.identcache, *.dsk, *.local, etc.) so source
checkouts stay clean.

delphi-backend/Source/PM.RateLimit.pas

@@ -0,0 +1,94 @@
+unit PM.RateLimit;
+
+{
+  Mirrors api.php checkRateLimit / recordAttempt / clearAttempts.
+  15-minute window. Caller decides the threshold (5 for register, 10 for login).
+}
+
+interface
+
+uses
+  System.SysUtils, FireDAC.Comp.Client, FireDAC.Stan.Param, IdCustomHTTPServer,
+  PM.Database;
+
+function GetClientIP(ARequest: TIdHTTPRequestInfo): string;
+function CheckRateLimit(const AIP: string): Integer;
+procedure RecordAttempt(const AIP: string);
+procedure ClearAttempts(const AIP: string);
+
+implementation
+
+function GetClientIP(ARequest: TIdHTTPRequestInfo): string;
+begin
+  // api.php trusts X-Forwarded-For (security flaw H1 in audit). Since this
+  // server is loopback-only and not behind a proxy, prefer the actual peer IP.
+  Result := ARequest.RemoteIP;
+  if Result = '' then Result := 'unknown';
+end;
+
+function CheckRateLimit(const AIP: string): Integer;
+var
+  LQ: TFDQuery;
+begin
+  Result := 0;
+  DB.Lock;
+  try
+    LQ := TFDQuery.Create(nil);
+    try
+      LQ.Connection := DB.Connection;
+      LQ.SQL.Text :=
+        'SELECT COUNT(*) AS cnt FROM login_attempts ' +
+        'WHERE ip = :ip ' +
+        'AND attempted_at > datetime(''now'', ''-15 minutes'')';
+      LQ.ParamByName('ip').AsString := AIP;
+      LQ.Open;
+      Result := LQ.FieldByName('cnt').AsInteger;
+    finally
+      LQ.Free;
+    end;
+  finally
+    DB.Unlock;
+  end;
+end;
+
+procedure RecordAttempt(const AIP: string);
+var
+  LQ: TFDQuery;
+begin
+  DB.Lock;
+  try
+    LQ := TFDQuery.Create(nil);
+    try
+      LQ.Connection := DB.Connection;
+      LQ.SQL.Text := 'INSERT INTO login_attempts (ip) VALUES (:ip)';
+      LQ.ParamByName('ip').AsString := AIP;
+      LQ.ExecSQL;
+    finally
+      LQ.Free;
+    end;
+  finally
+    DB.Unlock;
+  end;
+end;
+
+procedure ClearAttempts(const AIP: string);
+var
+  LQ: TFDQuery;
+begin
+  DB.Lock;
+  try
+    LQ := TFDQuery.Create(nil);
+    try
+      LQ.Connection := DB.Connection;
+      LQ.SQL.Text := 'DELETE FROM login_attempts WHERE ip = :ip';
+      LQ.ParamByName('ip').AsString := AIP;
+      LQ.ExecSQL;
+    finally
+      LQ.Free;
+    end;
+  finally
+    DB.Unlock;
+  end;
+end;
+
+end.