feat: profile avatar + tombstone-restore fix + WebView2 nav race + sync summary

Profile picture / avatar
- users.avatar_b64 column (nullable, cosmetic, not encrypted) + GET/POST
  /avatar endpoints mirroring the settings handler pattern.
- Top-right chip + Settings→Account show a round avatar: custom picture
  if set, otherwise the username's initial on a deterministic
  hash-picked colour (stable across renders).
- Upload downscales + center-crops to a 128px JPEG via FileReader →
  data: URI (NOT blob:, which the CSP's `img-src 'self' data:` blocks)
  before POSTing. Remove button clears it.
- Carried in the encrypted JSON export; restored on import only when the
  current account has no picture (never clobbers a local one).

Tombstone restore-then-sync fix
- POST /entries and POST /entries/bulk-import now DELETE any tombstone
  matching an inserted uuid (same transaction) so a restored backup
  isn't re-killed on the next sync by its own stale tombstone.
- applyRemoteSnapshot arbitrates remote tombstones by timestamp: a
  tombstone is skipped when the local entry with that uuid is newer than
  deleted_at (resurrection wins). Ties / unparseable timestamps favour
  KEEP. loadEntries() up front so updated_at reflects the live rows.

WebView2 navigation race
- Black-window-on-cold-start fix: the 1.5s nav timer no longer consumes
  FPendingURL when WebView2 isn't initialised yet (it re-arms, bounded
  to ~10 retries). FBrowserInitialized flag set in OnInitialized; after
  the retry budget we Navigate best-effort rather than loop forever.

Sync UX
- Bidirectional toast: "pulled X new · Y updated · Z deleted · pushed N
  entries" so a 0/0/0 pull still shows the vault was uploaded.
- FolderPOST/PUT: pre-declare ftString on color/icon params (fixes the
  earlier [SQLite]-335 on NULL bind, already in play for CSV import).

Docs
- CLAUDE.md sync section documents tombstone purge-on-insert +
  resurrection arbitration.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

delphi-backend/UMainForm.pas

@@ -76,6 +76,13 @@ type
     FBridge: TPMBridge;
     FPendingURL: string;
     FNavTimer: TTimer;
+    // Set once WebView2 fires OnInitialized. The nav timer only consumes
+    // FPendingURL when this is True — otherwise a timer tick that lands
+    // before the engine is ready would Navigate() into the void AND clear
+    // FPendingURL, leaving OnInitialized nothing to do → permanent black
+    // window on slow cold starts.
+    FBrowserInitialized: Boolean;
+    FNavRetries: Integer;   // bounded retry count for the deferred nav timer
     FRequireAccessToken: Boolean;
     FRequireProcessCheck: Boolean;
     FQuitting: Boolean;   // set when user picks "Quit" in tray menu — bypasses
@@ -288,6 +295,7 @@ begin
   // the engine is ready, so if a navigation is still pending here, do it
   // now. The timer either already ran (FPendingURL == '') or runs later
   // and no-ops on the empty string.
+  FBrowserInitialized := True;
   FNavTimer.Enabled := False;
   if FPendingURL <> '' then
   begin
@@ -435,6 +443,7 @@ begin
   if FServer.RequireAccessToken then
     FPendingURL := FPendingURL + '?pmt=' + FServer.AccessToken;
   LogLine('Will navigate embedded browser in ~1.5s to: ' + MaskAccessToken(FPendingURL));
+  FNavRetries := 0;
   FNavTimer.Enabled := False;
   FNavTimer.Enabled := True;
 end;
@@ -443,6 +452,23 @@ procedure TMainForm.NavTimerTick(Sender: TObject);
 begin
   FNavTimer.Enabled := False;
   if FPendingURL = '' then Exit;
+  // Engine not ready yet: Navigate() would be silently dropped. Leave
+  // FPendingURL intact and re-arm — either this timer catches the engine
+  // once it's up, or OnInitialized fires first and does the nav. Whoever
+  // wins clears FPendingURL so the other no-ops (no reload flash).
+  // Bounded to ~10 retries (15 s): if OnInitialized never fires (missing /
+  // broken WebView2 runtime), we stop deferring and attempt Navigate once
+  // anyway — best effort beats an eternal retry loop on a blank window.
+  if (not FBrowserInitialized) and (FNavRetries < 10) then
+  begin
+    Inc(FNavRetries);
+    LogLine(Format('Nav deferred — WebView2 not initialised (retry %d/10).',
+      [FNavRetries]));
+    FNavTimer.Enabled := True;
+    Exit;
+  end;
+  if not FBrowserInitialized then
+    LogLine('WebView2 still not initialised after retries — attempting nav anyway.');
   LogLine('Navigating to: ' + MaskAccessToken(FPendingURL));
   WebBrowser.Navigate(FPendingURL);
   FPendingURL := '';