feat: profile avatar + tombstone-restore fix + WebView2 nav race + sync summary

Profile picture / avatar
- users.avatar_b64 column (nullable, cosmetic, not encrypted) + GET/POST
  /avatar endpoints mirroring the settings handler pattern.
- Top-right chip + Settings→Account show a round avatar: custom picture
  if set, otherwise the username's initial on a deterministic
  hash-picked colour (stable across renders).
- Upload downscales + center-crops to a 128px JPEG via FileReader →
  data: URI (NOT blob:, which the CSP's `img-src 'self' data:` blocks)
  before POSTing. Remove button clears it.
- Carried in the encrypted JSON export; restored on import only when the
  current account has no picture (never clobbers a local one).

Tombstone restore-then-sync fix
- POST /entries and POST /entries/bulk-import now DELETE any tombstone
  matching an inserted uuid (same transaction) so a restored backup
  isn't re-killed on the next sync by its own stale tombstone.
- applyRemoteSnapshot arbitrates remote tombstones by timestamp: a
  tombstone is skipped when the local entry with that uuid is newer than
  deleted_at (resurrection wins). Ties / unparseable timestamps favour
  KEEP. loadEntries() up front so updated_at reflects the live rows.

WebView2 navigation race
- Black-window-on-cold-start fix: the 1.5s nav timer no longer consumes
  FPendingURL when WebView2 isn't initialised yet (it re-arms, bounded
  to ~10 retries). FBrowserInitialized flag set in OnInitialized; after
  the retry budget we Navigate best-effort rather than loop forever.

Sync UX
- Bidirectional toast: "pulled X new · Y updated · Z deleted · pushed N
  entries" so a 0/0/0 pull still shows the vault was uploaded.
- FolderPOST/PUT: pre-declare ftString on color/icon params (fixes the
  earlier [SQLite]-335 on NULL bind, already in play for CSV import).

Docs
- CLAUDE.md sync section documents tombstone purge-on-insert +
  resurrection arbitration.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

delphi-backend/Handlers/PM.Handler.Entries.pas

@@ -403,6 +403,15 @@ begin
       LQ.ParamByName('c2').AsString := LNow;
       LQ.ExecSQL;
       LNewId := DB.Connection.GetLastAutoGenValue('vault_entries');
+
+      // Clear any tombstone shadowing this uuid — a re-created entry
+      // (sync restore keeping its identity, or an undo of a hard
+      // delete) must not be silently re-killed on the next sync.
+      LQ.SQL.Text :=
+        'DELETE FROM entry_tombstones WHERE user_id = :uid AND uuid = :uuid';
+      LQ.ParamByName('uid').AsInteger := LUserId;
+      LQ.ParamByName('uuid').AsString := LUuid;
+      LQ.ExecSQL;
     finally
       LQ.Free;
     end;
@@ -1103,7 +1112,7 @@ var
   LArr, LIds: TJSONArray;
   LSite, LTitle, LUser, LFolder, LEnc, LIV, LTags, LTotpSec, LTotpIv, LNow,
     LKind, LCf, LCfIv, LIcon, LTemplate, LUuid: string;
-  LQ: TFDQuery;
+  LQ, LTomb: TFDQuery;
 begin
   try
     LUserId := Authenticate(ARequest, AResponse);
@@ -1141,8 +1150,18 @@ begin
       DB.Connection.StartTransaction;
       try
         LQ := TFDQuery.Create(nil);
+        // Reused across the batch to clear any tombstone shadowing an
+        // imported uuid. Without this, restoring a backup whose entries
+        // were previously hard-deleted (and tombstoned) would get those
+        // entries wiped again on the next sync — the tombstone outlives
+        // the resurrection. Purging here lets a restore actually stick.
+        LTomb := TFDQuery.Create(nil);
         try
           LQ.Connection := DB.Connection;
+          LTomb.Connection := DB.Connection;
+          LTomb.SQL.Text :=
+            'DELETE FROM entry_tombstones ' +
+            'WHERE user_id = :uid AND uuid = :uuid';
           LQ.SQL.Text :=
             'INSERT INTO vault_entries ' +
             '(user_id, site, title, username, encrypted_password, iv, encryption_method, ' +
@@ -1226,9 +1245,16 @@ begin
             LNewId := DB.Connection.GetLastAutoGenValue('vault_entries');
             LIds.AddElement(TJSONNumber.Create(LNewId));
             Inc(LImported);
+
+            // Clear any tombstone that would otherwise resurrect-then-kill
+            // this uuid on the next sync.
+            LTomb.ParamByName('uid').AsInteger := LUserId;
+            LTomb.ParamByName('uuid').AsString := LUuid;
+            LTomb.ExecSQL;
           end;
         finally
           LQ.Free;
+          LTomb.Free;
         end;
         DB.Connection.Commit;
       except