feat: secure notes + password history + custom fields + quick-win bundle

Big feature trio
- Secure notes (kind='login'|'note') reusing the encrypted_password+iv
  pipeline for the body. New sidebar entry, slideover variant (title +
  multiline body), distinct card / table-view rendering, badge in name
  column, copy-content button replacing the password copy on note rows.
- Password history: entries_password_history table keeps up to 20 prior
  ciphertexts per entry. HandleUpdateEntry pushes the pre-update
  encrypted_password into history ONLY when it actually differs from
  the incoming one (JS reuses originalEncrypted bit-for-bit when the
  plaintext is unchanged — avoids spamming history on title/folder edits).
  GET /entries/{id}/history endpoint. Slideover modal lists versions
  with mask/reveal/copy/revert. Master-pw rotation wipes history (old
  ciphertext can't be decrypted with the new key).
- Custom fields: per-entry encrypted JSON array of {label, value,
  is_secret}. Same crypto pipeline as the password. Slideover row UI
  with label/value inputs, secret toggle (eye), copy, delete. Re-
  encryption flows through bulk-import, change-master-password, and
  duplicate.

Quick wins
- Cheatsheet overlay (press '?' or topbar button or Ctrl+K). Lists all
  hotkeys + global / tray / card actions. SVG icons inline so the
  cheatsheet matches the actual app glyphs (no emoji mismatch).
- Open URL button on entry cards: ShellExecute via cmd://app/open-url,
  http(s) only, validates entry.site looks like a real hostname.
- Trash auto-purge: setting "Empty trash after N days" (never/7/30/90).
  DELETE /entries/trash/old?days=N called at every unlock.

Favicon strategy
- Subdomains (chat.deepseek.com, app.X.com…) now try the SLD first
  (deepseek.com.ico) before the full host. DDG often returns a generic
  placeholder for subdomains that passes the byte threshold; the SLD-first
  switch surfaces the real brand icon.
- Cap bumped 64 KB → 256 KB on all three sides (Delphi fetch, server
  endpoint, JS upload). DDG sometimes serves the full-res asset.

UX polish
- Click-outside-slideover: stopPropagation everywhere it bites. Custom
  fields buttons (add / delete / secret toggle / copy / eye) all stop
  the click bubble so the document-level "close on outside click" handler
  doesn't fire when rerender() detaches the target from the DOM.
- Native search-cancel button restyled: cyan accent X via mask-image,
  cursor: pointer, breathing room before the Ctrl+K kbd chip.
- Password history modal: scrollable body, multiline wrapped passwords,
  hover border highlight.
- Cheatsheet panel widened (560 → 720 px) so the descriptions no longer
  ellipsis-clip.
- "+ New" topbar splits into a small dropdown: New login / New note.
- Notes show a "note" badge in table-view name column, italic
  "Encrypted note" placeholder in the username column.

Internals
- duplicateEntry copies kind + custom_fields too (one-line forgotten
  earlier).
- entries_password_history dropped on master-pw rotation — the old
  ciphertexts are unrecoverable with the new key.
- bulk-import re-encryption path includes custom_fields.

CLAUDE.md
- "Entry payload — call sites à toucher ensemble" lists the 6 spots
  to update when adding a new (en)crypted field. Notes the historical
  miss of kind in duplicateEntry and custom_fields in the rotation +
  duplicate.

Repo hygiene
- .gitattributes forces CRLF on Delphi sources (RAD Studio refuses LF).
  text=auto for web frontend / docs, binary for .res / .exe / images.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

CLAUDE.md

@@ -353,6 +353,37 @@ viewMode change, pageSize change. Render via `renderPagination(total, totalPages
 Résout le cas "j'ai ajouté un mot de passe avec tri A-Z, où se loge-t-il ?"
 — scroll + pulse trouvent la nouvelle entry dans la grille triée.
 
+## Entry payload — call sites à toucher ensemble
+
+Une `vault_entries` row porte **plusieurs blobs chiffrés indépendants** :
+`encrypted_password/iv`, `totp_secret/totp_iv`, `custom_fields/custom_fields_iv`,
+plus le champ-icône `icon_b64` et les méta non chiffrées (`site, title,
+username, folder, tags, kind`).
+
+Quand tu ajoutes un nouveau champ (chiffré ou non), il faut **toujours**
+mettre à jour ces 6 endroits sous peine de perdre la donnée silencieusement
+sur certaines actions :
+
+1. **DB schema** : `PM.Database.CreateSchema` `AddColumnIfMissing(...)`
+2. **GET /entries** : `PM.Handler.Entries.HandleGetEntries` — ajouter au
+   `LObj.AddPair(...)` (NULL → `TJSONNull`)
+3. **POST + PUT /entries** : `HandleCreateEntry` + `HandleUpdateEntry` —
+   lire du body, binder le param, gérer `Clear` pour NULL
+4. **Master pw rotation** : `PM.Handler.Auth.HandleChangeMasterPassword` —
+   UPDATE doit inclure la colonne, sinon la rotation l'écrase à NULL
+5. **Master pw rotation JS** : `doChangeMasterPassword` → la boucle
+   `for (const e of state.entries)` re-chiffre chaque blob et push dans
+   `encrypted[]`. Manquer un champ chiffré = donnée perdue.
+6. **`duplicateEntry`** (js/app.js) — copier le blob chiffré tel quel
+   (même vault key, pas besoin de re-chiffrer)
+
+Bonus utile (pas critique) : `soDirtyCheck` doit comparer le nouveau
+champ, et `openSlideOver` doit le déchiffrer et l'exposer via `soState`.
+
+Historiquement on a oublié `kind` dans `duplicateEntry` (bug "Site required"
+sur duplique-note), et `custom_fields` dans la rotation + duplicate. Cette
+liste évite de répéter ces erreurs.
+
 ## Settings sync
 
 Per-user blob JSON dans `users.settings_json`, exposé via `GET/PUT