feat(crypto): encrypt username at rest (CODE_AUDIT §1.3)

username is no longer stored cleartext. New columns username_enc/username_iv
(AES-GCM under the vault key, same as encrypted_password). Search/sort/render
stay client-side, so the field is decrypted at loadEntries into e.username in
memory — everything downstream is unchanged. Full-strength random-IV AES-GCM
(no searchable/deterministic encryption) precisely because search is
client-side.

Server (PM.Handler.Entries / .Auth / PM.Database):
- Schema: vault_entries.username_enc, username_iv.
- GET returns them; POST/PUT/bulk-import read + persist them; master-pw
  rotation re-encrypts them under the new key (UPDATE + loop).
- ?q= server search drops `username LIKE` (ciphertext won't match; frontend
  searches client-side anyway).

Client (app.js / app.import.js):
- loadEntries/loadTrash decrypt username_enc → e.username (fallback to
  cleartext for un-migrated rows).
- withEncryptedUsername(obj): write choke point — encrypts obj.username into
  username_enc/username_iv and blanks the cleartext. Wraps every POST/PUT
  body: saveEntry, soSave, duplicateEntry, moveEntryToFolder, addTagToEntry,
  batchMove/AddTag, encryptImportEntry (import + sync-apply).
- doChangeMasterPassword re-encrypts username under the new key.
- migrateUsernamesAtRest(): one-time sweep at enterApp, PUT-re-ships rows that
  still carry cleartext username so the DB gets scrubbed (bumps updated_at
  once; plaintext unchanged so devices converge).

site/title/tags stay cleartext (same pattern later — see memory note). +1
merge test (username encrypted on import). 65/65.

NOT compiled/tested at runtime (Delphi) — large multi-handler change; rebuild
BuildAssets + PMServer and test create/edit/rotate/import/sync + verify the
DB shows no cleartext username.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

js/app.import.js

@@ -454,7 +454,9 @@ async function encryptImportEntry(plain) {
     const tagsStr = Array.isArray(plain.tags)
         ? plain.tags.filter(Boolean).join(',')
         : (plain.tags || '');
-    return {
+    // Encrypt the username at rest (username_enc/username_iv, cleartext blanked)
+    // via the shared choke point in app.js — same as the interactive save path.
+    return await withEncryptedUsername({
         uuid:               plain.uuid || '',
         site:               plain.site,
         title:              plain.title || '',
@@ -470,7 +472,7 @@ async function encryptImportEntry(plain) {
         custom_fields_iv:   cfIv,
         icon_b64:           plain.icon_b64 || '',
         template:           plain.template || '',
-    };
+    });
 }
 
 // Open a hidden file picker, route the result through the right parser,