feat: profile avatar + tombstone-restore fix + WebView2 nav race + sync summary

Profile picture / avatar
- users.avatar_b64 column (nullable, cosmetic, not encrypted) + GET/POST
  /avatar endpoints mirroring the settings handler pattern.
- Top-right chip + Settings→Account show a round avatar: custom picture
  if set, otherwise the username's initial on a deterministic
  hash-picked colour (stable across renders).
- Upload downscales + center-crops to a 128px JPEG via FileReader →
  data: URI (NOT blob:, which the CSP's `img-src 'self' data:` blocks)
  before POSTing. Remove button clears it.
- Carried in the encrypted JSON export; restored on import only when the
  current account has no picture (never clobbers a local one).

Tombstone restore-then-sync fix
- POST /entries and POST /entries/bulk-import now DELETE any tombstone
  matching an inserted uuid (same transaction) so a restored backup
  isn't re-killed on the next sync by its own stale tombstone.
- applyRemoteSnapshot arbitrates remote tombstones by timestamp: a
  tombstone is skipped when the local entry with that uuid is newer than
  deleted_at (resurrection wins). Ties / unparseable timestamps favour
  KEEP. loadEntries() up front so updated_at reflects the live rows.

WebView2 navigation race
- Black-window-on-cold-start fix: the 1.5s nav timer no longer consumes
  FPendingURL when WebView2 isn't initialised yet (it re-arms, bounded
  to ~10 retries). FBrowserInitialized flag set in OnInitialized; after
  the retry budget we Navigate best-effort rather than loop forever.

Sync UX
- Bidirectional toast: "pulled X new · Y updated · Z deleted · pushed N
  entries" so a 0/0/0 pull still shows the vault was uploaded.
- FolderPOST/PUT: pre-declare ftString on color/icon params (fixes the
  earlier [SQLite]-335 on NULL bind, already in play for CSV import).

Docs
- CLAUDE.md sync section documents tombstone purge-on-insert +
  resurrection arbitration.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

CLAUDE.md

@@ -489,7 +489,11 @@ device, never transmitted.
    auto-backup folder if enabled.
 2. `webdav/get` → 404 = first sync, treat as empty remote.
 3. Decrypt with `syncEncPwd` (reuses `encryptExportPayload` container).
-4. POST remote tombstones → server hard-deletes local matches.
+4. POST remote tombstones → server hard-deletes local matches, BUT
+   with resurrection arbitration : a remote tombstone (`{uuid, deleted_at}`)
+   is skipped if a local entry with that uuid has `updated_at > deleted_at`
+   (restored/edited after the delete → resurrection wins, no silent
+   re-kill). Ties + unparseable timestamps favour KEEP.
 5. Folders : add missing ones additively (don't touch existing).
 6. Entries : for each remote uuid → not in local = POST keeping uuid +
    restore attachments ; both sides have it = compare `updated_at`,
@@ -501,6 +505,17 @@ device, never transmitted.
 Sensitive actions (export, change master pw, recovery code…) still
 require master pw via `askReauth` — sync never substitutes.
 
+**Tombstone purge on (re)create** : `POST /entries` and
+`POST /entries/bulk-import` both DELETE any `entry_tombstones` row
+matching the inserted uuid (same transaction). Without this, restoring
+a backup whose entries were previously hard-deleted would leave the
+tombstone in place — the local `buildSyncSnapshot` would then re-push
+it and the next pull would kill the just-restored entries. Purge-on-
+insert + the resurrection arbitration (step 4) together make
+restore-then-sync actually stick. A live `vault_entries` row can never
+coexist with its tombstone (hard-delete removes the row), so `PUT`
+needs no purge.
+
 ## PIN unlock
 
 Optional shortcut unlock with a 4–12 digit PIN, complementary to Quick