feat(unlock): Quick unlock via DPAPI (remember on this device)

User-controlled opt-in to skip the master-password prompt on subsequent
app starts. The vault state (raw AES key + salt + username + session
token) is bundled and handed to the Delphi side, which DPAPI-encrypts
it with CRYPTPROTECT_CURRENT_USER and stashes the blob at
%LOCALAPPDATA%\PMServer\quickunlock.bin.

Honest threat model
===================
This is NOT biometric authentication. The DPAPI scope is the Windows
USER ACCOUNT — any process running as the same user can decrypt the
blob via the same DPAPI call. The security perimeter is the Windows
account itself. The Settings UI label is "Quick unlock" with an
explainer:
  "convenient on a personal machine, not safe on a shared one"

If the user has Windows Hello / fingerprint / PIN configured at the
OS level, then Windows login is biometric-gated and that gating
transitively applies to DPAPI access — but the cryptographic strength
of the encryption isn't tied to the biometric, it's tied to the
Windows account secret. Honest framing matters here, so the feature
isn't sold as "biometric".

Backend
=======
New unit Source/PM.QuickUnlock.pas:
 - StoreQuickUnlock(bytes) → DPAPI-encrypt and persist to
   %LOCALAPPDATA%\PMServer\quickunlock.bin
 - LoadQuickUnlock(out bytes) → read file, DPAPI-decrypt
 - ClearQuickUnlock → forget-me
 - HasQuickUnlock → file existence probe
DPAPI declarations are local (CryptProtectData / CryptUnprotectData
from crypt32.dll) — Winapi.WinCrypt's signatures drift across Delphi
versions and we don't want to fight that.

Bridge commands (UMainForm.HandleBridgeCommand):
 cmd://quickunlock/store?data=<base64>   payload opaque to Delphi
 cmd://quickunlock/get                   → ExecuteJavaScript callback
                                           Bridge.onQuickUnlockResult(b64|null)
 cmd://quickunlock/clear                 forget-me
 cmd://quickunlock/status                → Bridge.onQuickUnlockStatus(bool)

The get / status results are returned via ExecuteJavaScript rather than
HTTP (the bridge is request-only) — JS resolves a Promise that the
caller awaited.

Client
======
state.quickUnlockEnabled mirrors localStorage flag, lazy-cleared if the
backing DPAPI blob has gone missing (e.g., user reset Windows profile).

enableQuickUnlock():
  1. askReauth + /reauth to verify it's actually the user.
  2. exportKey('raw', state.cryptoKey) — extractable already.
  3. JSON-bundle { v, username, salt, token, csrf, key } → base64.
  4. cmd://quickunlock/store sends the blob to Delphi.

tryQuickUnlock() (called from init):
  1. Probe localStorage flag.
  2. cmd://quickunlock/get, await Bridge.onQuickUnlockResult.
  3. Decode JSON, importKey, restore state.* + sessionStorage.
  4. Return true on success, false to fall through to master-pw login.

Two restore scenarios both covered:
 A. Same app session (sessionStorage still populated, only cryptoKey
    was wiped by lock). tryQuickUnlock just restores the key.
 B. Cold start (sessionStorage empty). tryQuickUnlock restores
    EVERYTHING from the DPAPI blob, including the session token.

UI
==
Settings panel → new "Quick unlock" section above Recovery key.
Single toggle button: "Enable on this device" / "Disable" with status
line above. Opens settings → bridgeQuickUnlockStatus() reconciles the
JS-side flag with the actual file (drift detection).

Stale-blob protection
=====================
The stored blob holds the AES key BYTES, which would become useless
if the vault were re-encrypted under a different key. Three paths
that re-encrypt the vault now also wipe the DPAPI blob:
 - Explicit doLogout (user said "I'm done")
 - Master password change (new key, old blob can't decrypt anything)
 - (Recovery redeem already forces master pw change → covered.)

The blob persists across the passive lockVault() flow on purpose —
that's the whole point: lock without losing convenience.

Init wiring
===========
On app start, the existing "restore session from sessionStorage" path
now falls through to tryQuickUnlock if either sessionStorage is empty
OR the cryptoKey is gone. Auth screen shows up only after both
attempts fail.

delphi-backend/PMServer.dpr

@@ -15,6 +15,7 @@ uses
   PM.Session in 'Source\PM.Session.pas',
   PM.HTTPServer in 'Source\PM.HTTPServer.pas',
   PM.Bridge in 'Source\PM.Bridge.pas',
+  PM.QuickUnlock in 'Source\PM.QuickUnlock.pas',
   PM.Handler.Ping in 'Handlers\PM.Handler.Ping.pas',
   PM.Handler.Auth in 'Handlers\PM.Handler.Auth.pas',
   PM.Handler.Folders in 'Handlers\PM.Handler.Folders.pas',

delphi-backend/PMServer.dproj

@@ -214,6 +214,7 @@ $(PreBuildEvent)]]></PreBuildEvent>
         <DCCReference Include="Source\PM.Session.pas"/>
         <DCCReference Include="Source\PM.HTTPServer.pas"/>
         <DCCReference Include="Source\PM.Bridge.pas"/>
+        <DCCReference Include="Source\PM.QuickUnlock.pas"/>
         <DCCReference Include="Handlers\PM.Handler.Ping.pas"/>
         <DCCReference Include="Handlers\PM.Handler.Auth.pas"/>
         <DCCReference Include="Handlers\PM.Handler.Folders.pas"/>

delphi-backend/Source/PM.QuickUnlock.pas

@@ -0,0 +1,208 @@
+unit PM.QuickUnlock;
+
+{
+  Quick unlock — persistent on-device cache of the vault key, encrypted
+  with the Windows DPAPI (CryptProtectData with CRYPTPROTECT_CURRENT_USER).
+  Designed so the user can unlock the vault on a trusted device without
+  retyping the master password every time.
+
+  Threat model & honesty
+  ----------------------
+  This is NOT biometric authentication. The cached key is tied to the
+  Windows USER ACCOUNT — any process running as the same user can read
+  it back via the same DPAPI call. The security perimeter is therefore
+  the Windows account itself.
+
+  If the user has Windows Hello / fingerprint / PIN configured at the
+  OS level, then logging into Windows implies biometric / strong-cred
+  authentication, which transitively gates DPAPI access. Without that
+  OS-level configuration, this feature is "convenience unlock", not
+  cryptographic 2FA.
+
+  Storage
+  -------
+  Encrypted blob lives at
+    %LOCALAPPDATA%\PMServer\quickunlock.bin
+  One blob per Windows user. Multiple vault accounts on the same machine
+  share the file — only the last opt-in wins. Acceptable for v1 since
+  the typical Windows-user-to-vault-account ratio is 1:1.
+
+  Wire format
+  -----------
+  The bytes passed to Store/Load are opaque to this unit. The bridge
+  layer (UMainForm) hands us the UTF-8 bytes of a JSON object that
+  carries whatever the JS layer needs at restore time (currently the
+  raw vault key + username + salt — see app.js).
+}
+
+interface
+
+uses
+  System.SysUtils, System.Classes, System.IOUtils,
+  Winapi.Windows;
+
+// Persist APayload (DPAPI-encrypted) for the current Windows user.
+// Returns False on any I/O or DPAPI failure — caller decides whether
+// to surface the error.
+function StoreQuickUnlock(const APayload: TBytes): Boolean;
+
+// Read + decrypt. Returns False when no blob exists, the file is
+// corrupted, or DPAPI fails (e.g., user account changed).
+function LoadQuickUnlock(out APayload: TBytes): Boolean;
+
+// Delete the blob file. Idempotent — silent if the file is absent.
+procedure ClearQuickUnlock;
+
+// Is a blob currently stored?
+function HasQuickUnlock: Boolean;
+
+implementation
+
+// ---------------------------------------------------------------------------
+//  DPAPI declarations
+// ---------------------------------------------------------------------------
+// Winapi.WinCrypt provides these on some Delphi versions, but the declarations
+// are inconsistent across releases. Declare locally so the unit doesn't
+// depend on a specific RTL revision.
+
+type
+  TDataBlob = record
+    cbData: DWORD;
+    pbData: PByte;
+  end;
+  PDataBlob = ^TDataBlob;
+
+function CryptProtectData(pDataIn: PDataBlob; szDataDescr: PWideChar;
+  pOptionalEntropy: PDataBlob; pvReserved: Pointer; pPromptStruct: Pointer;
+  dwFlags: DWORD; pDataOut: PDataBlob): BOOL; stdcall;
+  external 'crypt32.dll' name 'CryptProtectData';
+
+function CryptUnprotectData(pDataIn: PDataBlob; ppszDataDescr: PPWideChar;
+  pOptionalEntropy: PDataBlob; pvReserved: Pointer; pPromptStruct: Pointer;
+  dwFlags: DWORD; pDataOut: PDataBlob): BOOL; stdcall;
+  external 'crypt32.dll' name 'CryptUnprotectData';
+
+function LocalFree(hMem: HLOCAL): HLOCAL; stdcall;
+  external 'kernel32.dll' name 'LocalFree';
+
+// ---------------------------------------------------------------------------
+//  Storage helpers
+// ---------------------------------------------------------------------------
+
+function StorageDir: string;
+begin
+  // %LOCALAPPDATA%\PMServer — per-user, roaming-disabled. DPAPI keys live
+  // alongside the user profile so they survive Windows updates but not
+  // a profile reset.
+  Result := TPath.Combine(
+    GetEnvironmentVariable('LOCALAPPDATA'),
+    'PMServer');
+end;
+
+function StorageFile: string;
+begin
+  Result := TPath.Combine(StorageDir, 'quickunlock.bin');
+end;
+
+procedure EnsureStorageDir;
+begin
+  if not TDirectory.Exists(StorageDir) then
+    TDirectory.CreateDirectory(StorageDir);
+end;
+
+// ---------------------------------------------------------------------------
+//  Public API
+// ---------------------------------------------------------------------------
+
+function StoreQuickUnlock(const APayload: TBytes): Boolean;
+var
+  LIn, LOut: TDataBlob;
+  LStream: TFileStream;
+begin
+  Result := False;
+  if Length(APayload) = 0 then Exit;
+
+  LIn.cbData := Length(APayload);
+  LIn.pbData := @APayload[0];
+  LOut.pbData := nil;
+  LOut.cbData := 0;
+
+  // No optional entropy, no description, no flags. Default scope is
+  // CRYPTPROTECT_CURRENT_USER → ties to the Windows user account.
+  if not CryptProtectData(@LIn, nil, nil, nil, nil, 0, @LOut) then Exit;
+  try
+    EnsureStorageDir;
+    LStream := TFileStream.Create(StorageFile, fmCreate);
+    try
+      LStream.WriteBuffer(LOut.pbData^, LOut.cbData);
+    finally
+      LStream.Free;
+    end;
+    Result := True;
+  finally
+    if LOut.pbData <> nil then LocalFree(HLOCAL(LOut.pbData));
+  end;
+end;
+
+function LoadQuickUnlock(out APayload: TBytes): Boolean;
+var
+  LEncrypted: TBytes;
+  LIn, LOut: TDataBlob;
+  LStream: TFileStream;
+begin
+  Result := False;
+  SetLength(APayload, 0);
+
+  if not TFile.Exists(StorageFile) then Exit;
+
+  // Read encrypted bytes from disk.
+  try
+    LStream := TFileStream.Create(StorageFile, fmOpenRead or fmShareDenyWrite);
+    try
+      SetLength(LEncrypted, LStream.Size);
+      if Length(LEncrypted) > 0 then
+        LStream.ReadBuffer(LEncrypted[0], LStream.Size);
+    finally
+      LStream.Free;
+    end;
+  except
+    Exit;
+  end;
+  if Length(LEncrypted) = 0 then Exit;
+
+  LIn.cbData := Length(LEncrypted);
+  LIn.pbData := @LEncrypted[0];
+  LOut.pbData := nil;
+  LOut.cbData := 0;
+
+  // Decrypt. Fails if the current Windows user differs from the one
+  // that called Store (different machine, profile reset, etc.) — we
+  // return False so the caller falls back to the master-pw flow.
+  if not CryptUnprotectData(@LIn, nil, nil, nil, nil, 0, @LOut) then Exit;
+  try
+    SetLength(APayload, LOut.cbData);
+    if LOut.cbData > 0 then
+      Move(LOut.pbData^, APayload[0], LOut.cbData);
+    Result := True;
+  finally
+    if LOut.pbData <> nil then LocalFree(HLOCAL(LOut.pbData));
+  end;
+end;
+
+procedure ClearQuickUnlock;
+begin
+  try
+    if TFile.Exists(StorageFile) then
+      TFile.Delete(StorageFile);
+  except
+    // Best-effort cleanup. File-system errors aren't worth surfacing
+    // for what's a "forget me" action.
+  end;
+end;
+
+function HasQuickUnlock: Boolean;
+begin
+  Result := TFile.Exists(StorageFile);
+end;
+
+end.

delphi-backend/UMainForm.pas

@@ -9,7 +9,7 @@ uses
   FMX.Dialogs,
   FMX.TMSFNCTypes, FMX.TMSFNCUtils, FMX.TMSFNCGraphics, FMX.TMSFNCGraphicsTypes,
   FMX.TMSFNCCustomControl, FMX.TMSFNCWebBrowser,
-  PM.HTTPServer, PM.Bridge;
+  PM.HTTPServer, PM.Bridge, PM.QuickUnlock;
 
 type
   TMainForm = class(TForm)
@@ -279,6 +279,59 @@ begin
     LogLine('Clipboard cleared by JS request');
   end
 
+  // ---- Quick unlock (DPAPI persistence of the vault key) ----
+  // store: client provides a base64-encoded blob (UTF-8 JSON, content
+  //   opaque to us). We DPAPI-encrypt and stash on disk.
+  // get:   we DPAPI-decrypt, base64-encode, send back via ExecuteJavaScript.
+  // clear: forget-me.
+  else if ACmd = 'quickunlock/store' then
+  begin
+    LText := GetParam('data');   // base64 of UTF-8 JSON blob
+    if LText = '' then Exit;
+    var LBytes := TNetEncoding.Base64.DecodeStringToBytes(LText);
+    if PM.QuickUnlock.StoreQuickUnlock(LBytes) then
+      LogLine(Format('Quick unlock stored (%d bytes)', [Length(LBytes)]))
+    else
+      LogLine('Quick unlock store FAILED (DPAPI error)');
+  end
+
+  else if ACmd = 'quickunlock/get' then
+  begin
+    var LBytes: TBytes;
+    if PM.QuickUnlock.LoadQuickUnlock(LBytes) and (Length(LBytes) > 0) then
+    begin
+      var LB64 := TNetEncoding.Base64.EncodeBytesToString(LBytes);
+      // Strip newlines that the Base64 encoder may insert (line-wrapping
+      // breaks the JS-side decoder) before injecting into a JS string.
+      LB64 := StringReplace(LB64, #13, '', [rfReplaceAll]);
+      LB64 := StringReplace(LB64, #10, '', [rfReplaceAll]);
+      WebBrowser.ExecuteJavaScript(
+        'if(window.Bridge&&Bridge.onQuickUnlockResult)' +
+        'Bridge.onQuickUnlockResult("' + LB64 + '")');
+      LogLine('Quick unlock served');
+    end
+    else
+    begin
+      WebBrowser.ExecuteJavaScript(
+        'if(window.Bridge&&Bridge.onQuickUnlockResult)' +
+        'Bridge.onQuickUnlockResult(null)');
+    end;
+  end
+
+  else if ACmd = 'quickunlock/clear' then
+  begin
+    PM.QuickUnlock.ClearQuickUnlock;
+    LogLine('Quick unlock cleared');
+  end
+
+  else if ACmd = 'quickunlock/status' then
+  begin
+    WebBrowser.ExecuteJavaScript(
+      'if(window.Bridge&&Bridge.onQuickUnlockStatus)' +
+      'Bridge.onQuickUnlockStatus(' +
+      BoolToStr(PM.QuickUnlock.HasQuickUnlock, True).ToLower + ')');
+  end
+
   else
     LogLine('Bridge: unknown command "' + ACmd + '"');
 end;