feat: Delphi backend + JS↔Delphi bridge (clipboard, tray, auto-lock)

Introduces the Delphi 12 FMX backend (PMServer) that hosts the embedded
WebView2 vault on 127.0.0.1, and a native bridge between JS and Delphi
that wires three privacy-focused features:

1. Secure clipboard
   Copying a password registers the Win32 "ExcludeClipboardContentFromMonitorProcessing"
   format alongside CF_UNICODETEXT, so Win+V clipboard history never sees
   the value. Auto-clears after 30s via TTimer. Bridge.copySecure() in
   app.js routes all password/username/secret copy paths through the
   native layer when running inside the Delphi WebView2 (falls back to
   navigator.clipboard for the PHP standalone).

2. Tray icon (X-to-tray when server running)
   Closing the dev panel hides both the form HWND and the TFMAppClass
   per-process proxy window that owns the FMX taskbar entry — the form's
   HWND alone is not the taskbar-visible one in FMX (took some iteration
   to discover). Tray menu: Open, Lock vault, Quit. Clipboard is force-
   cleared on minimize as extra safety. First-time minimize fires a
   balloon notification so the user knows the app is still running.

3. Auto-lock on Windows session lock (Win+L)
   wtsapi32.dll!WTSRegisterSessionNotification on a dedicated message-only
   window. On WM_WTSSESSION_CHANGE / WTS_SESSION_LOCK, the bridge calls
   ExecuteJavaScript('lockVault()'). Same path used by the tray "Lock vault"
   menu item.

Bridge architecture:
 - JS → Delphi via cmd:// URLs intercepted in OnBeforeNavigate
   (pattern lifted from DeskInsight Monaco). Currently exposes
   cmd://clipboard/copy?text=...&clear=... and cmd://clipboard/clear.
 - Delphi → JS via TTMSFNCWebBrowser.ExecuteJavaScript with guarded
   calls (typeof check) so the bridge degrades cleanly if app.js isn't
   loaded yet.

Files:
 - Source/PM.Bridge.pas (new) — TSecureClipboard + TPMBridge
 - UMainForm.pas/.fmx — bridge wiring, FormCloseQuery intercept, tray
   callbacks (BridgeTrayRestore / BridgeLockRequest / BridgeQuit)
 - js/app.js — Bridge object, 5 navigator.clipboard sites migrated to
   Bridge.copySecure with PHP-compatible fallback, Bridge.onTrayRestore
   handler that resets the auto-lock timer

.gitignore extended with Delphi build artifacts (*.dcu, Win32/, Win64/,
__history/, __recovery/, *.identcache, *.dsk, *.local, etc.) so source
checkouts stay clean.

delphi-backend/Source/PM.Router.pas

@@ -0,0 +1,104 @@
+unit PM.Router;
+
+{
+  URL dispatcher. Mirrors the switch(true) pattern of api.php.
+  Each handler unit registers its routes here. The Router itself owns no state.
+}
+
+interface
+
+uses
+  System.SysUtils, System.Classes, System.Generics.Collections,
+  System.RegularExpressions,
+  IdCustomHTTPServer;
+
+type
+  TRouteParams = TArray<string>;
+
+  TRouteHandler = reference to procedure(
+    ARequest: TIdHTTPRequestInfo;
+    AResponse: TIdHTTPResponseInfo;
+    const AParams: TRouteParams);
+
+  TRoute = record
+    Method: string;
+    Pattern: string;           // regex; ^ and $ added automatically
+    Regex: TRegEx;
+    Handler: TRouteHandler;
+  end;
+
+  TPMRouter = class
+  private
+    FRoutes: TList<TRoute>;
+  public
+    constructor Create;
+    destructor Destroy; override;
+    procedure Register(const AMethod, APattern: string;
+      const AHandler: TRouteHandler);
+    function DispatchRequest(ARequest: TIdHTTPRequestInfo;
+      AResponse: TIdHTTPResponseInfo): Boolean;
+  end;
+
+var
+  Router: TPMRouter;
+
+implementation
+
+constructor TPMRouter.Create;
+begin
+  inherited;
+  FRoutes := TList<TRoute>.Create;
+end;
+
+destructor TPMRouter.Destroy;
+begin
+  FRoutes.Free;
+  inherited;
+end;
+
+procedure TPMRouter.Register(const AMethod, APattern: string;
+  const AHandler: TRouteHandler);
+var
+  R: TRoute;
+begin
+  R.Method := UpperCase(AMethod);
+  R.Pattern := APattern;
+  R.Regex := TRegEx.Create('^' + APattern + '$');
+  R.Handler := AHandler;
+  FRoutes.Add(R);
+end;
+
+function TPMRouter.DispatchRequest(ARequest: TIdHTTPRequestInfo;
+  AResponse: TIdHTTPResponseInfo): Boolean;
+var
+  LRoute: TRoute;
+  LMatch: TMatch;
+  LParams: TRouteParams;
+  I: Integer;
+  LMethod, LPath: string;
+begin
+  Result := False;
+  LMethod := UpperCase(ARequest.Command);
+  LPath := ARequest.Document;
+  for LRoute in FRoutes do
+  begin
+    if LRoute.Method <> LMethod then Continue;
+    LMatch := LRoute.Regex.Match(LPath);
+    if LMatch.Success then
+    begin
+      SetLength(LParams, LMatch.Groups.Count - 1);
+      for I := 1 to LMatch.Groups.Count - 1 do
+        LParams[I - 1] := LMatch.Groups[I].Value;
+      LRoute.Handler(ARequest, AResponse, LParams);
+      Exit(True);
+    end;
+  end;
+end;
+
+initialization
+  Router := TPMRouter.Create;
+
+finalization
+  Router.Free;
+
+end.