fix(crypto): SHA-256 wrap auth hash so vault.db at rest no longer = AES key

THE PROBLEM
===========
Before this commit, users.password_hash stored on the server contained
PBKDF2(pw, salt, iters) in hex — the exact same 32 bytes the client
uses as the AES-GCM key to encrypt every entry. Anyone who got hold of
vault.db (filesystem access, backup leak, etc.) had the encryption key
in their hand, no brute force needed. The increased PBKDF2 iteration
count from the previous commit helped against the cipher-text path,
but the easier path was right there in the user row.

THE FIX
=======
Wrap the PBKDF2 output in SHA-256 before storing:

  password_hash = SHA256(PBKDF2(pw, salt, iters))

SHA-256 is one-way. The stored hash can still be verified at login
(server recomputes PBKDF2 from the posted master pw, then SHA-256s it,
compares to stored), but the AES key can no longer be recovered from
it. At rest, vault.db only contains an irreversible derivative.

The server still sees pw transiently during /login while computing
the comparison — eliminating that requires a redesigned auth
protocol where the client sends a pre-computed verifier (SRP, OPAQUE,
or simply SHA-256(PBKDF2(pw, salt, iters)) sent from the client).
That's a separate, larger refactor. This commit closes the at-rest
hole, which is the realistic attack surface for vault file leaks.

SCHEMA / MARKER
===============
users.hash_algo distinguishes the two schemes:
  'pbkdf2'        — LEGACY (raw hex, = AES key)
  'pbkdf2-sha256' — CURRENT (SHA-256-wrapped, one-way)

A constant HASH_ALGO_CURRENT replaces the string literal everywhere
to avoid silent drift between the writer and the reader sides.

MIGRATION
=========
Folded into the existing /migrate-kdf endpoint introduced for the
100k→600k iteration bump. Login response now signals migration on
EITHER:
  - kdf_iterations < PBKDF2_ITERATIONS_TARGET, OR
  - hash_algo != 'pbkdf2-sha256'

The endpoint handles both transitions in one atomic transaction:
  UPDATE users SET password_hash = SHA256(PBKDF2(pw, salt, 600k)),
                   kdf_iterations = 600000,
                   hash_algo = 'pbkdf2-sha256'
  UPDATE vault_entries SET encrypted_password, iv (per entry, if KDF changed)

Idempotency tightened: the "already at target" short-circuit now
requires BOTH conditions, not just the iteration count. Without this,
users who migrated KDF before this commit landed would have been
stuck on the legacy hash format.

CLIENT
======
runKdfMigration() branches on whether the KDF actually changed:
  - kdfChange (fromIters !== toIters): re-encrypt all entries with the
    new key, send them in the entries array, swap state.cryptoKey on
    success. Shows "Vault security upgraded" toast.
  - !kdfChange (hash format only): skip the entry re-encryption loop
    entirely, send entries: []. Silent — the user didn't perceive a
    weakness change worth toasting about.

LOGIN / REAUTH
==============
Both now branch on hash_algo to pick the right verifier:
  HASH_ALGO_LEGACY  → ConstantTimeEquals(stored, PBKDF2(pw, salt, iters))
  HASH_ALGO_CURRENT → ConstantTimeEquals(stored, SHA256(PBKDF2(pw, salt, iters)))

Same constant-time comparison helper as before. Same legacy bcrypt
fallback (still 501-not-implemented).

ALL THREE SCENARIOS AFTER THIS COMMIT
=====================================
1. New register: starts at HASH_ALGO_CURRENT + 600k. No migration ever.
2. Legacy 100k + 'pbkdf2': full migration on next login (hash format
   + iter count + entry re-encryption) in one transaction.
3. Mid-state (already-migrated KDF + still-'pbkdf2'): hash format
   upgrade only on next login, no entry re-encryption.

js/app.js

@@ -377,38 +377,55 @@ async function runKdfMigration(masterPwd, fromIters, toIters) {
     kdfMigrationInProgress = true;
 
     try {
-        // Derive the new key. The old key is already in state.cryptoKey
-        // (used to decrypt the entries we just loaded).
-        const newKey = await deriveKey(masterPwd, state.salt, toIters);
+        // Two distinct migration scenarios:
+        //   A. fromIters !== toIters: KDF iteration count is changing, so
+        //      the AES key is changing. We re-encrypt every entry with the
+        //      new key + fresh IVs, swap state.cryptoKey at the end.
+        //   B. fromIters === toIters: same KDF, only the server-side hash
+        //      format is being upgraded (legacy "pbkdf2" raw → "pbkdf2-sha256"
+        //      wrapped). No entry re-encryption needed — just trigger the
+        //      endpoint so the server rewrites the user row.
+        const kdfChange = fromIters !== toIters;
+        let newKey, newCiphertexts;
 
-        // Re-encrypt every entry. Each entry gets a fresh random IV under
-        // the new key — never reuse the old IV with the new key (would be
-        // pointless but also a small information leak via IV reuse patterns).
-        const newCiphertexts = [];
-        for (const entry of state.entries) {
-            const plain = await decryptPwd(entry.encrypted_password, entry.iv);
-            if (plain === '[ERROR]') {
-                // One decrypt failure aborts the whole migration — better to
-                // stay on the legacy config than to commit partial state.
-                throw new Error('Could not decrypt entry id=' + entry.id);
-            }
-            const tmpKey = state.cryptoKey;
-            try {
-                state.cryptoKey = newKey;
-                const re = await encryptPwd(plain);
-                newCiphertexts.push({
-                    id:                 entry.id,
-                    encrypted_password: re.encrypted,
-                    iv:                 re.iv,
-                });
-            } finally {
-                state.cryptoKey = tmpKey;       // restore for any concurrent read
+        if (kdfChange) {
+            newKey = await deriveKey(masterPwd, state.salt, toIters);
+            // Re-encrypt every entry. Each entry gets a fresh random IV
+            // under the new key — never reuse the old IV with the new key
+            // (would be pointless but also a small information leak via IV
+            // reuse patterns).
+            newCiphertexts = [];
+            for (const entry of state.entries) {
+                const plain = await decryptPwd(entry.encrypted_password, entry.iv);
+                if (plain === '[ERROR]') {
+                    // One decrypt failure aborts the whole migration —
+                    // better to stay on the legacy config than commit
+                    // partial state.
+                    throw new Error('Could not decrypt entry id=' + entry.id);
+                }
+                const tmpKey = state.cryptoKey;
+                try {
+                    state.cryptoKey = newKey;
+                    const re = await encryptPwd(plain);
+                    newCiphertexts.push({
+                        id:                 entry.id,
+                        encrypted_password: re.encrypted,
+                        iv:                 re.iv,
+                    });
+                } finally {
+                    state.cryptoKey = tmpKey; // restore for any concurrent read
+                }
             }
+        } else {
+            // Hash-format-only upgrade — server still wants an entries
+            // array (it's an idempotent transactional update), just empty.
+            newCiphertexts = [];
         }
 
         // Send the atomic migrate request. Server verifies the master pw
-        // against the OLD hash, then updates hash + iterations + every
-        // entry in a single transaction.
+        // against the OLD hash, then updates the user row (hash, iter
+        // count, hash_algo) AND every entry's ciphertext in a single
+        // transaction.
         await api('/migrate-kdf', {
             method: 'POST',
             headers: authHeaders({ 'Content-Type': 'application/json' }),
@@ -418,19 +435,22 @@ async function runKdfMigration(masterPwd, fromIters, toIters) {
             }),
         });
 
-        // Server committed → switch our in-memory crypto key and update
-        // the cached ciphertexts in state.entries so subsequent reads use
-        // the new key transparently.
-        state.cryptoKey = newKey;
-        await persistCryptoKey();
-        for (let i = 0; i < state.entries.length; i++) {
-            const nc = newCiphertexts[i];
-            state.entries[i].encrypted_password = nc.encrypted_password;
-            state.entries[i].iv                 = nc.iv;
+        if (kdfChange) {
+            // Swap to the new AES key + update cached ciphertexts.
+            state.cryptoKey = newKey;
+            await persistCryptoKey();
+            for (let i = 0; i < state.entries.length; i++) {
+                const nc = newCiphertexts[i];
+                state.entries[i].encrypted_password = nc.encrypted_password;
+                state.entries[i].iv                 = nc.iv;
+            }
+            toast('Vault security upgraded (' + fromIters.toLocaleString() +
+                  ' → ' + toIters.toLocaleString() + ' KDF iterations)');
+        } else {
+            // Format-only upgrade is silent — the user didn't perceive a
+            // weakness change, and nothing visible in the UI changed.
+            // (A subtle "Auth format upgraded" toast felt noisy.)
         }
-
-        toast('Vault security upgraded (' + fromIters.toLocaleString() +
-              ' → ' + toIters.toLocaleString() + ' KDF iterations)');
     } catch (err) {
         // Silent retry on next login — the migration is idempotent and
         // safe to abandon (server rolled back).